CVE-2025-66301 json
Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
published 11mo ago modified last mo. also EUVD-2025-200109 , GHSA-v8x2-fjv7-8hjh
- cvss
- 9.6
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 1
- Metasploit
Summary
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
Patch / fix
- packagist getgrav/grav 1.8.0-beta.27
- getgrav grav 1.8.0-beta.27
- getgrav grav_cms 1.8.0-beta.27
Is CVE-2025-66301 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/multi/http/grav_twig_ssti_sandbox_bypass_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 11mo ago
Exploit prediction
1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/http/grav_twig_ssti_sandbox_bypass_rce Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE metasploit exploit, excellent rank, 2025-12-01
- github.com https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | getgrav/grav | <1.8.0-beta.27 |
1.8.0-beta.27 |
Affected products
- getgrav grav
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
github.com
/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh
exploit, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-66301
advisory
-
github.com
/getgrav/grav
package
Sources
- CVE List CVE-2025-66301
- GitHub Advisory GHSA-v8x2-fjv7-8hjh
- NVD CVE-2025-66301
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.