CVE-2025-66294: Getgrav Grav RCE Vulnerability

CVE-2025-66294 Overview

CVE-2025-66294 is a high-severity Server-Side Template Injection (SSTI) vulnerability in Grav, a popular open-source file-based Web platform. This vulnerability allows authenticated attackers with editor permissions to execute arbitrary commands on the server. Under certain conditions, it may also be exploited by unauthenticated attackers, significantly increasing the risk profile of affected installations.

The vulnerability stems from weak regex validation in the cleanDangerousTwig method, which fails to properly sanitize user-controlled input before it is processed by the Twig templating engine. With a CVSS score of 8.7 and an EPSS probability of 47.06% (97th percentile), this vulnerability presents a significant risk to organizations running vulnerable versions of Grav CMS.

Critical Impact
Attackers can achieve remote code execution on vulnerable Grav installations, potentially leading to complete server compromise, data exfiltration, and lateral movement within the network.

Affected Products

Grav CMS versions prior to 1.8.0-beta.27
Grav CMS 1.8.0-beta1 through 1.8.0-beta26
All stable Grav releases prior to the patched version

Discovery Timeline

December 1, 2025 - CVE-2025-66294 published to NVD
December 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-66294

Vulnerability Analysis

This Server-Side Template Injection vulnerability (CWE-94: Improper Control of Generation of Code) exists within Grav's Twig template processing functionality. Grav utilizes the Twig templating engine to render dynamic content, and the platform implements a cleanDangerousTwig method intended to sanitize potentially dangerous template directives before execution.

The vulnerability carries a CVSS 4.0 vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, indicating:

Network-based attack vector - Exploitable remotely over the network
Low attack complexity - No specialized conditions required
Low privileges required - Authenticated users with editor permissions can exploit this
No user interaction needed - Exploitation can occur without victim involvement
High impact on confidentiality, integrity, and availability - Complete system compromise possible

Root Cause

The root cause of CVE-2025-66294 lies in the insufficient regex-based validation implemented within the cleanDangerousTwig method. This method was designed to filter out potentially dangerous Twig template constructs before they are processed by the templating engine. However, the regex patterns used for validation are too permissive, allowing attackers to craft payloads that bypass the sanitization logic.

Template injection vulnerabilities occur when user input is embedded into template strings that are subsequently evaluated by the template engine. In Twig, attackers can leverage various built-in functions and filters to execute arbitrary PHP code on the server. The weak regex validation fails to account for all possible encoding variations, whitespace manipulation, and alternative syntax constructs that can be used to bypass the filter.

Attack Vector

The attack vector for CVE-2025-66294 is network-based and requires the attacker to have authenticated access with editor permissions in the Grav admin panel. Once authenticated, the attacker can inject malicious Twig template code through content editing interfaces.

The exploitation flow involves:

Attacker authenticates to the Grav admin panel with editor-level privileges
Attacker crafts a malicious Twig template payload designed to bypass the cleanDangerousTwig regex validation
The malicious payload is submitted through a content editing interface
The Twig engine processes the unsanitized payload, executing arbitrary code on the server
The attacker gains command execution capabilities on the underlying server

Under certain conditions, unauthenticated attackers may also exploit this vulnerability, potentially through cached content or misconfigured access controls. See the security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f for detailed technical information on exploitation methods.

Detection Methods for CVE-2025-66294

Indicators of Compromise

Unusual Twig template syntax in page content or configuration files
Unexpected PHP function calls in server access logs
Anomalous process spawning from web server processes (e.g., php-fpm, apache2, nginx)
New files created in web directories with suspicious content
Outbound network connections from web server to unusual destinations

Detection Strategies

Organizations should implement multi-layered detection strategies to identify potential exploitation attempts:

Web Application Firewall (WAF) Rules: Configure WAF rules to detect and block common SSTI payloads targeting Twig templating engine. Look for patterns containing Twig delimiters ({{, }}, {%, %}) combined with dangerous functions like system, exec, passthru, or filter constructs.

Log Analysis: Monitor web application logs for requests containing encoded or obfuscated Twig syntax. Pay particular attention to POST requests to admin panel endpoints that handle content editing.

File Integrity Monitoring: Implement file integrity monitoring on Grav installation directories to detect unauthorized modifications to template files or the creation of new executable content.

Behavioral Analysis: Monitor for anomalous behavior patterns such as web server processes executing system commands, spawning child processes, or establishing outbound network connections.

Monitoring Recommendations

Security teams should implement continuous monitoring for the following:

Admin Panel Activity: Log and alert on content modifications made through the Grav admin panel, particularly those containing template syntax
Process Monitoring: Use endpoint detection and response (EDR) solutions to monitor for suspicious process chains originating from web server processes
Network Traffic Analysis: Monitor for command-and-control traffic patterns and data exfiltration attempts from web servers
Version Tracking: Maintain an inventory of Grav installations and their versions to quickly identify vulnerable systems

How to Mitigate CVE-2025-66294

Immediate Actions Required

Upgrade Grav CMS to version 1.8.0-beta.27 or later immediately
Review admin panel access logs for suspicious activity
Audit user accounts with editor or higher permissions
Implement Web Application Firewall (WAF) rules to block SSTI payloads
Enable enhanced logging on Grav installations pending upgrade

Patch Information

The vulnerability is addressed in Grav version 1.8.0-beta.27. The security patch improves the regex validation in the cleanDangerousTwig method to properly sanitize dangerous Twig template constructs.

Patch Commit: The fix is available in commit e37259527d9c1deb6200f8967197a9fa587c6458

Patch URL: https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458

Organizations should prioritize upgrading to the patched version. Review the vendor security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f for complete upgrade instructions and additional security recommendations.

Workarounds

If immediate patching is not possible, organizations should implement the following temporary mitigations:

Restrict Admin Access: Limit access to the Grav admin panel by IP address using web server configuration or firewall rules. Only allow trusted administrative IP addresses to access the /admin endpoint.

Review User Permissions: Audit all user accounts with editor permissions and remove access from any accounts that do not require content editing capabilities.

Enable Two-Factor Authentication: If available, enable two-factor authentication for all admin panel accounts to reduce the risk of unauthorized access.

Deploy WAF Protection: Implement Web Application Firewall rules specifically designed to detect and block Server-Side Template Injection payloads targeting Twig.

bash

# Example: Restrict admin access by IP in Apache .htaccess
<Location /admin>
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Location>