CVE-2025-66294
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 2.82%
- CWE
- CWE-94, CWE-1336
- Published
- 2025-12-01
- Last modified
- 2026-03-13
Affected products
- getgrav grav
Weakness type
Related vulnerabilities
- CVE-2026-81803 — WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability
- CVE-2026-66632 — WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
- CVE-2026-80352 — Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
- CVE-2026-19584 — Velociraptor VQL injection during notebook restore from backup
- CVE-2026-87926 — Rizwan17 inventory-management-system Login Page index.php cross site scripting
- CVE-2026-87923 — Rizwan17 inventory-management-system List DBOperation.php cross site scripting
- CVE-2026-87817 — GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
- CVE-2026-41870 — Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)