Loading...
Skip to main content
GeekWala

CVE-2025-66844 — Vulnerability in getgrav/grav — CVE Details

CRITICAL

Grav may be vulnerable to SSRF attack via Twig Templates

Published December 15, 2025Updated December 17, 2025Source: osv

Summary

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.

Advisory Timeline

  • First published December 15, 2025 (301 days ago).
  • Last revised December 17, 2025 — 2 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
getgrav/grav
packagist
0.8.0, 0.9.0, 0.9.1, 0.9.10 (+281 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-918
    Server-Side Request Forgery (SSRF)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2025-66844?
Grav may be vulnerable to SSRF attack via Twig Templates This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-66844?
CVE-2025-66844 affects getgrav/grav. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-66844 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-729w-j79f-2c34

Related CVEs

  • CVE-2026-75827
    CRITICAL

    Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

  • CVE-2025-66294
    HIGH

    Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

  • CVE-2026-42844
    HIGH

    Low-privileged Grav API users can create super-admin accounts via blueprint-upload

  • CVE-2026-69088
    HIGH

    Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

  • CVE-2025-66297
    HIGH

    Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

  • CVE-2026-42612
    HIGH

    Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

  • CVE-2026-65608
    HIGH

    Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

  • CVE-2025-66296
    HIGH

    Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies