Grav CMS Under Threat: CVE-2025-66297 Allows Remote Code Execution and Privilege Escalation

Overview

CVE-2025-66297 describes a critical security vulnerability affecting Grav, a file-based Web platform. This flaw allows a user with admin panel access and permissions to create or edit pages to escalate their privileges to administrator and execute arbitrary system commands. The vulnerability stems from the ability to enable Twig processing within page frontmatter, leading to potential Remote Code Execution (RCE) and Privilege Escalation (PE). This vulnerability has been addressed in Grav version 1.8.0-beta.27.

Technical Details

The vulnerability lies in the insufficient sanitization of Twig expressions when enabled within the page frontmatter. An attacker with appropriate permissions can inject malicious Twig code. This injected code is then processed by the Grav CMS engine. This processing allows the attacker to leverage the scheduler API to execute arbitrary system commands on the server, potentially gaining complete control of the system. Prior to version 1.8.0-beta.27, the vulnerability was unpatched, making Grav installations running earlier versions vulnerable.

CVSS Analysis

Note: As per the provided data, a CVSS score and severity are not available for CVE-2025-66297. However, based on the description (Remote Code Execution and Privilege Escalation), it would likely be assessed as a Critical severity vulnerability with a CVSS score potentially in the range of 9.0-10.0, if formally assessed. This is due to the ease of exploitation (attacker only needs admin panel access and page edit permissions) and the devastating impact (full system compromise).

Possible Impact

The impact of this vulnerability is severe. Successful exploitation can lead to:

• Remote Code Execution (RCE): Attackers can execute arbitrary code on the server, potentially taking complete control of the system.
• Privilege Escalation (PE): Attackers can escalate their privileges to administrator, gaining full access to the Grav CMS and its associated data.
• Data Breach: Attackers can access and steal sensitive data stored within the Grav CMS.
• Website Defacement: Attackers can modify the website content, defacing it or injecting malicious code.
• Denial of Service (DoS): Attackers can crash the server or make it unavailable to legitimate users.

Mitigation and Patch Steps

The recommended mitigation is to upgrade to Grav CMS version 1.8.0-beta.27 or later. This version contains the fix for CVE-2025-66297.

1. Backup your Grav CMS installation: Before applying any updates, create a backup of your files and database (if applicable).
2. Update Grav CMS: Use the Grav Package Manager (GPM) or manually update the Grav CMS to version 1.8.0-beta.27 or later. Refer to the official Grav documentation for instructions.
3. Verify the update: After the update, verify that the Grav CMS version is 1.8.0-beta.27 or later.
4. Review user permissions: Ensure that users have only the necessary permissions to minimize the potential impact of future vulnerabilities.

References

• Grav Commit e37259527d9c1deb6200f8967197a9fa587c6458
• Grav Security Advisory GHSA-858q-77wx-hhx6