Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-66299: Grav CMS lets editors run code on server

CVE-2025-66299 · published 11 months ago

Summary

In versions of Grav CMS before 1.8.0‑beta.27, a user who can edit content could insert special template code that makes the system execute any command on the web server. This bypasses the built‑in safety checks and could let an attacker take control of the server. Updating Grav to version 1.8.0‑beta.27 or later removes the flaw.

What to do

Update getgrav grav to version 1.8.0-beta.27.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	getgrav	grav	< 1.8.0-beta.27 Fix: upgrade to 1.8.0-beta.27
–	getgrav	grav	< 1.8.0 1.8.0 `cpe:2.3:a:getgrav:grav::::::::`

Original advisory text

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.

References

https://github.com/advisories/GHSA-gjc5-8cfh-653x
https://github.com/getgrav/grav/security/advisories/GHSA-gjc5-8cfh-653x Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66299... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-66299 Vendor Advisory
https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458 Patch

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

CWE-1336Improper Neutralization of Special Elements Used in a Template Engine

Timeline

Published1 Dec 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-gjc5-8cfh-653x · GHSA

CVE-2025-66299 · NVD

CVE-2025-66299 · OSV

Track software like this

Free during beta