CVE-2025-66297

Katalog CVE

CVSS 8.8 · High EPSS 0,78%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine pada getgrav grav. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.

Rincian

Terbit di NVD

1 Desember 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458 patch
• https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6 exploit · advisory pihak ketiga