CVE-2025-66298: getgrav grav

Vulnerability summary

CVE-2025-66298 is a high (CVSS 7.7) vulnerability in getgrav grav. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-12-2025
   PublishedVulnerability first disclosed.
2. 02-12-2025
   Last modifiedVulnerability information updated.

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.

• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.