Grav CVE-2025-66294

Primary path requires an authenticated account with Grav editor (pages) permissions plus the official Form and Admin plugins installed; the attacker creates or edits a form with a 'message' process action whose value is passed to Twig processString/cleanDangerousTwig, and uses nested function calls (e.g. via evaluate/evaluate_twig) to bypass the weak sanitization regex. A secondary, more limited unauthenticated path is possible ONLY when a form already exists that accepts user input and feeds it through evaluate_twig. Limiting factors: default editor-privilege requirement (PR:L), dependence on the Form/Admin plugins, and - for the guest case - a pre-existing vulnerable form configuration. Fixed in 1.8.0-beta.27.

This is a genuine high-priority vulnerability, not a paper CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) describes network-reachable, low-complexity code execution with full confidentiality/integrity/availability impact requiring only low privileges (an 'editor' account). The signals reinforce each other rather than conflict: EPSS is 38.34% (97th percentile) - exceptionally high and consistent with the publicly available exploit code in the GHSA advisory and the confirmed vendor patch commit. Publicly available exploit code exists, but this is NOT confirmed active exploitation - the CVE is not listed in CISA KEV, so treat it as high exploitation *likelihood* rather than proven in-the-wild use. One nuance to verify: the CVSS PR:L reflects the primary editor-authenticated path, but both the description and GHSA advisory state that under certain conditions (a pre-existing form that feeds user input through evaluate_twig) an *unauthenticated* attacker can also achieve RCE - meaning realistic worst-case risk exceeds the PR:L-based score for some deployments. The root cause (weak regex in cleanDangerousTwig / Twig sandbox bypass) is confirmed by the source diff. Overall: real priority, patch urgently.

An attacker with a low-privileged Grav editor account (or, where a public form already routes submitted input through evaluate_twig, an unauthenticated visitor) crafts a Twig payload using nested function calls that slip past the cleanDangerousTwig regex, achieving server-side template injection and arbitrary command execution as the web server user. Publicly available exploit code and a detailed write-up exist in the GHSA-662m-56v4-3r8f advisory, lowering the barrier to weaponization.