UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66294

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig…

Severity
High 8.7
Published
1 Dec 2025
Last changed
26 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.0
Sources
NVD

Affected software

SoftwareAffected versions
GravServers and applications · cpe:a:getgrav:grav
  • Version 1.8.0-beta26
  • Version 1.8.0-beta25
  • Version 1.8.0-beta24
  • Version 1.8.0-beta23
All 27 release lines
  • From 1.7.48 before 1.8.0
  • Version 1.8.0-beta1
  • Version 1.8.0-beta2
  • Version 1.8.0-beta3
  • Version 1.8.0-beta4
  • Version 1.8.0-beta5
  • Version 1.8.0-beta6
  • Version 1.8.0-beta7
  • Version 1.8.0-beta8
  • Version 1.8.0-beta9
  • Version 1.8.0-beta10
  • Version 1.8.0-beta11
  • Version 1.8.0-beta12
  • Version 1.8.0-beta13
  • Version 1.8.0-beta14
  • Version 1.8.0-beta15
  • Version 1.8.0-beta16
  • Version 1.8.0-beta17
  • Version 1.8.0-beta18
  • Version 1.8.0-beta19
  • Version 1.8.0-beta20
  • Version 1.8.0-beta21
  • Version 1.8.0-beta22
  • Version 1.8.0-beta23
  • Version 1.8.0-beta24
  • Version 1.8.0-beta25
  • Version 1.8.0-beta26

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66294
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66294