CVE-2025-66305: Critical DoS Vulnerability in Grav CMS Admin Panel

On December 1st, 2025, a critical security vulnerability was disclosed in Grav CMS, a popular file-based Web platform. Designated as CVE-2025-66305, this vulnerability allows an attacker to trigger a Denial of Service (DoS) condition by providing malformed input to the Grav admin configuration panel.

Overview

CVE-2025-66305 affects versions of Grav CMS prior to 1.8.0-beta.27. The vulnerability resides within the “Languages” submenu of the Grav admin configuration panel (/admin/config/system), specifically the “Supported” parameter. Improper validation of user input allows an attacker to inject a malicious value, leading to a fatal error and causing the entire Grav site to become unavailable.

Technical Details

The root cause of this vulnerability lies in the insufficient input validation of the “Supported” parameter within the Languages configuration. Specifically, the application uses the preg_match() function with a regular expression that can be broken by specific inputs. When a malformed value, such as a single forward slash (/) or an XSS-like string, is submitted, the regular expression parsing fails catastrophically. This failure results in a fatal error that crashes the application and prevents all users from accessing the site. The vulnerability exploits the improper use of regular expressions leading to a non-recoverable error in the core of the Grav application.

The following code snippet (illustrative) shows a simplified representation of the vulnerable code:

    
    $supportedLanguages = $_POST['supported']; // Untrusted input

    // Vulnerable regular expression usage
    if (preg_match('/' . $supportedLanguages . '/', 'some_test_string')) {
        // ... further processing ...
    } else {
        // Handle the error (incorrectly!)
    }
    
  

CVSS Analysis

While the severity and CVSS score are listed as N/A, the impact of this vulnerability is significant. A successful exploit results in a complete Denial of Service, rendering the website inaccessible to all users. Exploitation is relatively simple, requiring only the ability to access the Grav admin panel with sufficient privileges (likely administrator). Given the ease of exploitation and the severity of the impact, this vulnerability should be considered high risk.

Possible Impact

The successful exploitation of CVE-2025-66305 can have severe consequences:

• Website Downtime: The primary impact is complete website unavailability, leading to lost revenue, damaged reputation, and user frustration.
• Data Integrity: While the vulnerability itself doesn’t directly compromise data, prolonged downtime can lead to indirect data integrity issues or loss of business.
• Reputational Damage: Extended website outages can significantly damage a website’s reputation and erode user trust.

Mitigation and Patch Steps

The vulnerability has been patched in Grav version 1.8.0-beta.27. The recommended course of action is to immediately update your Grav CMS installation to this version or a later version. Follow these steps:

1. Backup your website: Before performing any updates, create a complete backup of your Grav website, including files and database (if applicable).
2. Update Grav: Use the Grav Package Manager (GPM) to update Grav to the latest version (bin/gpm update from your Grav root). Or update from the admin panel if possible.
3. Verify the update: After the update, verify that your Grav installation is running version 1.8.0-beta.27 or higher.
4. Monitor your website: Monitor your website for any unexpected behavior after the update.

If immediate updating is not possible, consider temporarily restricting access to the admin panel or implementing input validation on the “Supported” parameter as a temporary workaround (advanced users only).

References

• GitHub Commit: ed640a13143c4177af013cf001969ed2c5e197ee
• GitHub Security Advisory: GHSA-m8vh-v6r6-w7p6