Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-66294

Good to know:

icon
icon

Date: December 1, 2025

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.

Severity Score

Related Resources (5)

https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458
https://nvd.nist.gov/vuln/detail/CVE-2025-66294
https://github.com/getgrav/grav
https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f
https://www.mend.io/vulnerability-database/CVE-2025-66294

Severity Score

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

Improper Neutralization of Special Elements Used in a Template Engine

CWE-1336

Top Fix

icon

Upgrade Version

Upgrade to version getgrav/grav - 1.8.0-beta.27;https://github.com/getgrav/grav.git - 1.8.0-beta.27

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us