Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Grav <1.7.49.5: Malicious Code Can Send Fake HTTP Requests

CVE-2025-66844 · published 10 months ago
Summary

If you're using an outdated version of Grav, a hacker could potentially trick the system into making unauthorized HTTP requests. This could lead to sensitive information being exposed or compromised. Update to version 1.7.49.5 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer getgrav grav <= 1.7.49.5
Original advisory text
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be ...
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published15 Dec 2025
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-729w-j79f-2c34 · GHSA
CVE-2025-66844 · NVD
CVE-2025-66844 · OSV
Track software like this
Free during beta