CVE-2025-66297: Getgrav Grav CMS RCE Vulnerability

CVE-2025-66297 Overview

CVE-2025-66297 is a high-severity vulnerability affecting Grav CMS, a popular file-based Web platform. This vulnerability allows authenticated users with admin panel access and page creation/editing permissions to exploit Server-Side Template Injection (SSTI) through Twig template processing in page frontmatter. By injecting malicious Twig expressions, attackers can escalate privileges to full admin access or execute arbitrary system commands via the scheduler API, resulting in both Privilege Escalation (PE) and Remote Code Execution (RCE).

Critical Impact

Authenticated attackers can leverage SSTI to escalate privileges and achieve remote code execution on vulnerable Grav CMS installations, potentially leading to complete system compromise.

Affected Products

• Grav CMS versions prior to 1.8.0-beta.27
• Grav CMS 1.8.0-beta1 through 1.8.0-beta26
• All stable Grav CMS versions before the patched release

Discovery Timeline

• 2025-12-01 - CVE-2025-66297 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-66297

Vulnerability Analysis

This vulnerability is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The CVSS 4.0 score is 7.4 (HIGH) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

The vulnerability stems from insufficient sanitization of user-controlled input in page frontmatter when Twig processing is enabled. Grav CMS uses the Twig templating engine for dynamic content rendering, and when users with page editing privileges enable Twig processing in frontmatter, they can inject arbitrary Twig expressions that are evaluated by the server.

The EPSS (Exploit Prediction Scoring System) score is 0.286% (51.7th percentile), indicating a moderate probability of exploitation in the wild.

Root Cause

The root cause lies in the improper neutralization of special elements within user-supplied content that gets processed by the Twig template engine. When page frontmatter allows Twig processing, the application fails to adequately restrict or sanitize template expressions, enabling attackers to inject malicious code that executes in the server context.

The vulnerability allows bypassing intended access controls by:

1. Enabling Twig processing in page frontmatter configuration
2. Injecting malicious Twig expressions that access internal application objects
3. Leveraging the scheduler API to execute arbitrary system commands

Attack Vector

The attack vector is Network-based with low attack complexity. An authenticated attacker with permissions to create or edit pages can exploit this vulnerability without user interaction. The attacker must have access to the Grav admin panel and appropriate page management permissions.

The exploitation flow involves:

1. Authenticating to the Grav CMS admin panel with a user account that has page creation/editing privileges
2. Creating or editing a page and enabling Twig processing in the frontmatter
3. Injecting malicious Twig template expressions to access privileged application functions
4. Executing arbitrary commands through the scheduler API or escalating privileges to admin

For detailed technical information about the exploitation mechanism, refer to the security advisory.

Detection Methods for CVE-2025-66297

Indicators of Compromise

• Unexpected Twig expressions in page frontmatter containing system commands or privilege escalation attempts
• Unusual scheduler API calls from non-admin user accounts
• Modified user privileges or unexpected admin account creation
• Suspicious page modifications enabling Twig processing
• Command execution artifacts in server logs originating from the web application context

Detection Strategies

Organizations should implement the following detection strategies:

1. Log Analysis: Monitor Grav CMS access logs for unusual page editing patterns, especially those involving frontmatter modifications that enable Twig processing
2. File Integrity Monitoring: Track changes to page files in the user/pages/ directory for suspicious Twig expressions
3. User Activity Monitoring: Alert on privilege escalation events or unexpected changes to user roles
4. Web Application Firewall (WAF): Configure rules to detect and block common SSTI payloads in HTTP requests to the admin panel

Monitoring Recommendations

SentinelOne customers benefit from real-time threat detection capabilities that can identify SSTI exploitation attempts and post-exploitation activities. Organizations should:

• Enable comprehensive logging for Grav CMS admin panel activities
• Monitor for unusual process spawning from web server processes
• Track file system changes in Grav CMS directories
• Alert on scheduler API invocations from unexpected user contexts
• Implement behavioral analysis to detect privilege escalation patterns

How to Mitigate CVE-2025-66297

Immediate Actions Required

• Upgrade Grav CMS to version 1.8.0-beta.27 or later immediately
• Review and audit all user accounts with page editing permissions
• Examine existing pages for malicious Twig expressions in frontmatter
• Restrict admin panel access to trusted networks using firewall rules
• Implement the principle of least privilege for all CMS user accounts

Patch Information

The vulnerability has been fixed in Grav CMS version 1.8.0-beta.27. The patch is available in commit e37259527d9c1deb6200f8967197a9fa587c6458 on the official GitHub repository.

To update Grav CMS, administrators can use the built-in update mechanism through the admin panel or manually download the patched version from the official repository. The patch addresses the improper neutralization of template expressions by implementing proper input validation and restricting access to dangerous Twig functions.

Workarounds

If immediate patching is not possible, consider the following temporary mitigations:

• Disable Twig processing in page frontmatter at the system configuration level
• Remove page creation and editing permissions from non-essential user accounts
• Implement network-level restrictions to limit admin panel access
• Monitor for exploitation attempts using the detection strategies outlined above

# Restrict admin panel access via .htaccess (Apache)
<Directory "/path/to/grav/admin">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Directory>