CVE-2025-66302: Getgrav Grav Path Traversal Vulnerability

CVE-2025-66302 Overview

CVE-2025-66302 is a path traversal vulnerability [CWE-22] in Grav CMS, a file-based web platform. The flaw exists in the backup tool, where user-supplied paths are not properly sanitized or restricted. Authenticated attackers with administrative privileges can read arbitrary files outside the intended webroot directory. The impact depends on the privileges of the operating system account running the Grav application. The vulnerability affects all versions prior to 1.8.0-beta.27 and is fixed in that release.

Critical Impact
Authenticated administrators can read arbitrary files on the underlying server filesystem, potentially exposing configuration files, credentials, and sensitive system data.

Affected Products

Getgrav Grav versions prior to 1.8.0-beta.27
All Grav 1.8.0 beta releases from beta1 through beta26
Grav CMS installations exposing the administrative backup tool

Discovery Timeline

2025-12-01 - CVE-2025-66302 published to NVD
2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-66302

Vulnerability Analysis

The vulnerability resides in the backup component of Grav CMS. The backup tool accepts user-supplied path parameters from authenticated administrative users without enforcing strict containment within the application webroot. Because the input is not normalized or validated against an allowlist of permitted directories, attackers can supply directory traversal sequences to escape the intended path. The result is arbitrary file read on the server filesystem, scoped to whatever the Grav process can access.

The scope-changed CVSS vector indicates that successful exploitation impacts resources beyond the vulnerable component itself. The flaw requires administrative authentication, which limits the attacker population but raises the value of any compromised admin account or session.

Root Cause

The root cause is insufficient input sanitization in the backup tool. User-supplied paths are not canonicalized and not constrained to the Grav installation directory. The application fails to reject ../ sequences and absolute paths before resolving the requested file. This omission allows traversal outside the webroot and into arbitrary locations on the host filesystem.

Attack Vector

An authenticated attacker holding administrative privileges in the Grav admin panel issues a crafted request to the backup functionality. The request includes a path containing traversal sequences or an absolute path pointing to a sensitive file. The server resolves the path without restriction and returns the file contents. Targets typically include /etc/passwd, application configuration files containing secrets, SSH keys, and database connection files.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-j422-qmxp-hv94 and the upstream fix is visible in the GitHub Commit Update.

Detection Methods for CVE-2025-66302

Indicators of Compromise

Web server access logs containing ../ sequences or URL-encoded variants such as %2e%2e%2f in requests to the Grav admin backup endpoints.
Backup tool requests referencing absolute paths to system files such as /etc/passwd, /etc/shadow, or application configuration directories.
Unexpected outbound transfers of unusually large archive responses from the Grav admin interface.

Detection Strategies

Monitor administrative endpoints under the Grav /admin route for parameter values containing path traversal patterns.
Correlate administrator login events with subsequent backup tool usage and flag deviations from baseline admin activity.
Inspect generated backup archives for inclusion of files outside the Grav installation directory.

Monitoring Recommendations

Enable verbose logging on the Grav admin plugin and forward logs to a centralized analytics platform for retention and search.
Alert on any admin-authenticated request whose decoded parameter values contain .., null bytes, or absolute filesystem paths.
Track the running version of Grav across deployments to confirm patched builds remain in place after updates.

How to Mitigate CVE-2025-66302

Immediate Actions Required

Upgrade Grav CMS to version 1.8.0-beta.27 or later on all affected installations.
Rotate credentials, API tokens, and secrets that may have been exposed through configuration files readable by the Grav process.
Audit administrator accounts and remove unused or stale admin users, enforcing strong authentication and multi-factor authentication where supported.

Patch Information

The vulnerability is fixed in Grav 1.8.0-beta.27. The corrective change is published in the GitHub Commit Update and documented in the GitHub Security Advisory GHSA-j422-qmxp-hv94. Administrators should apply the upgrade through the standard Grav update workflow and verify the installed version after deployment.

Workarounds

Restrict network access to the Grav /admin interface using IP allowlisting, VPN, or a web application firewall until patching completes.
Run the Grav application under a dedicated low-privilege operating system account to limit the scope of files readable through the flaw.
Apply WAF rules that block requests to admin endpoints containing path traversal sequences such as ../, ..\, and their URL-encoded forms.

bash

# Configuration example: verify patched Grav version
cd /var/www/grav
php bin/grav --version

# Example nginx rule to block traversal attempts against admin endpoints
# location ~ ^/admin/ {
#     if ($args ~* "(\.\./|%2e%2e%2f|%2e%2e/)") { return 403; }
# }