CVE-2025-66294

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.

Affected

getgrav · grav

CVSS v4.0 GITHUB

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 GitHub

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

2.82% chance of exploitation in the next 30 days, 86th percentile

Published

2025-12-01

Updated

2025-12-02

Proof-of-concept exploits (1)

• advisories/GHSA-662m-56v4-3r8f

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grav_twig_ssti_sandbo…

Security advisories

• getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f
• getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458

References

• CVE Record
• NVD entry