CVE-2025-66305: Getgrav Grav DoS Vulnerability

CVE-2025-66305 Overview

CVE-2025-66305 is a Denial of Service (DoS) vulnerability discovered in Grav, a popular file-based Web platform. The vulnerability exists in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input, allowing an authenticated administrator to crash the entire application by inserting malformed values such as a single forward slash (/) or XSS test strings.

When exploited, the vulnerability triggers a fatal regular expression parsing error on the server due to improper construction of regular expressions passed to PHP's preg_match() function. This results in an application-wide failure, rendering the site completely unavailable to all users until manual intervention.

Critical Impact

Authenticated administrators can cause complete site unavailability through improper input in the Languages configuration, affecting all users and requiring manual recovery.

Affected Products

• Grav versions prior to 1.8.0-beta.27
• Grav 1.8.0-beta1 through 1.8.0-beta26
• All stable Grav releases before the patch

Discovery Timeline

• 2025-12-01 - CVE-2025-66305 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-66305

Vulnerability Analysis

This vulnerability is classified under CWE-248 (Uncaught Exception) and represents an Improper Input Validation issue that leads to Denial of Service. The vulnerability carries a CVSS 4.0 score of 6.9 (MEDIUM severity) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

The EPSS (Exploit Prediction Scoring System) probability is 0.062% with a percentile ranking of 19.381, indicating a relatively low likelihood of exploitation in the wild.

The vulnerability stems from insufficient input validation in the Languages configuration section of the Grav admin panel. When a user with administrative privileges enters a malformed string in the Supported languages parameter, the application attempts to use this input to construct a regular expression pattern. Since the input is not sanitized or validated for regex metacharacters, invalid patterns cause PHP's preg_match() function to fail catastrophically.

Root Cause

The root cause is the direct use of unsanitized user input in the construction of regular expressions. When special regex characters like / are provided without proper escaping, the resulting pattern becomes syntactically invalid. PHP's PCRE (Perl Compatible Regular Expressions) engine throws a fatal error when attempting to compile or execute such malformed patterns.

The vulnerable code path does not implement:

1. Input validation to reject invalid language codes
2. Proper escaping of regex metacharacters using preg_quote()
3. Error handling for regex compilation failures

Attack Vector

The attack requires network access and high privileges (administrator access to the Grav admin panel). An attacker with administrative credentials can navigate to /admin/config/system, locate the Languages submenu, and enter a malformed value in the Supported parameter field.

The attack is straightforward to execute: simply entering a single forward slash (/) character or other regex metacharacters will trigger the vulnerability. Once the configuration is saved, the malformed value causes a fatal error on subsequent requests, resulting in complete site unavailability.

The vulnerability mechanism involves the Grav application passing user-supplied language codes directly to preg_match() without validation. When malformed input is provided, the regex engine encounters a syntax error, throwing an uncaught exception that propagates up and crashes the application. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-66305

Indicators of Compromise

• PHP fatal errors in server logs referencing preg_match() function failures
• Sudden application unavailability following admin panel configuration changes
• Error messages containing "preg_match(): Unknown modifier" or similar regex-related errors
• Unusual values in the Grav system configuration files for language settings

Detection Strategies

Organizations can detect potential exploitation attempts by:

1. Log Monitoring: Monitor PHP error logs for fatal errors related to preg_match() function calls, particularly those originating from language-related code paths.

2. Configuration Auditing: Regularly audit the Grav system configuration files for unexpected or malformed values in language settings.

3. Admin Activity Tracking: Implement logging for all administrative configuration changes, particularly in the system settings area.

4. Web Application Firewall (WAF): Configure WAF rules to detect and alert on suspicious patterns being submitted to the admin configuration endpoints.

Monitoring Recommendations

• Enable verbose PHP error logging in production environments (while ensuring errors are not displayed to end users)
• Implement application performance monitoring (APM) to detect sudden availability drops
• Set up automated alerts for HTTP 500 errors on the Grav application
• Monitor the /admin/config/system endpoint for unusual POST requests
• Configure backup and recovery procedures to minimize downtime if exploitation occurs

How to Mitigate CVE-2025-66305

Immediate Actions Required

• Upgrade Grav to version 1.8.0-beta.27 or later immediately
• Review admin user accounts and remove or disable any unnecessary administrative access
• Audit recent configuration changes in the Languages settings for suspicious values
• Implement network-level access controls to restrict admin panel access to trusted IP addresses

Patch Information

The vulnerability has been fixed in Grav version 1.8.0-beta.27. The patch is available in commit ed640a13143c4177af013cf001969ed2c5e197ee.

The fix implements proper input validation for the Supported languages parameter, ensuring that only valid language codes can be entered and that any special characters are properly handled before being used in regular expression operations.

Organizations should:

1. Review the GitHub Security Advisory GHSA-m8vh-v6r6-w7p6 for complete details
2. Download and apply the patched version from the official Grav repository
3. Test the update in a staging environment before deploying to production

Workarounds

If immediate patching is not possible, organizations can implement the following temporary mitigations:

1. Restrict Admin Access: Limit access to the Grav admin panel to only essential personnel and trusted IP addresses using web server configuration or firewall rules.

2. Read-Only Configuration: Where possible, set the Grav configuration files to read-only to prevent modifications through the admin panel.

3. Monitoring and Alerting: Implement enhanced monitoring for the admin configuration endpoints and set up immediate alerts for any configuration changes.

# Restrict admin panel access via Apache .htaccess
<Directory "/var/www/html/grav/admin">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Directory>

# Or via Nginx configuration
location /admin {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
}