UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66299

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods,…

Severity
High 8.8
Published
1 Dec 2025
Last changed
26 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.0
Sources
NVD

Affected software

SoftwareAffected versions
GravServers and applications · cpe:a:getgrav:grav
  • Version 1.8.0-beta26
  • Version 1.8.0-beta25
  • Version 1.8.0-beta24
  • Version 1.8.0-beta23
All 27 release lines
  • Every version before 1.8.0
  • Version 1.8.0-beta1
  • Version 1.8.0-beta2
  • Version 1.8.0-beta3
  • Version 1.8.0-beta4
  • Version 1.8.0-beta5
  • Version 1.8.0-beta6
  • Version 1.8.0-beta7
  • Version 1.8.0-beta8
  • Version 1.8.0-beta9
  • Version 1.8.0-beta10
  • Version 1.8.0-beta11
  • Version 1.8.0-beta12
  • Version 1.8.0-beta13
  • Version 1.8.0-beta14
  • Version 1.8.0-beta15
  • Version 1.8.0-beta16
  • Version 1.8.0-beta17
  • Version 1.8.0-beta18
  • Version 1.8.0-beta19
  • Version 1.8.0-beta20
  • Version 1.8.0-beta21
  • Version 1.8.0-beta22
  • Version 1.8.0-beta23
  • Version 1.8.0-beta24
  • Version 1.8.0-beta25
  • Version 1.8.0-beta26

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66299
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66299