High severity · published Dec 1, 2025
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
< 1.8.0-beta.27 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66297
Patch
https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458
Exploit
https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)