What is the CVSS score of CVE-2025-66294?

CVE-2025-66294 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 38.3%.

Which versions of Grav are affected by CVE-2025-66294?

A critical Server-Side Template Injection vulnerability in Grav CMS (CVE-2025-66294) allows authenticated editors and potentially unauthenticated attackers to execute arbitrary commands on affected…. A patch is available.

Is there a public PoC exploit available for CVE-2025-66294?

Yes, a public proof-of-concept exploit is available for CVE-2025-66294. Prioritise patching immediately. EPSS: 38.3%.

How to fix or mitigate CVE-2025-66294?

Within 24 hours: Inventory all Grav installations and identify versions below 1.8.0-beta.27; restrict editor access to trusted personnel only and review recent activity logs for suspicious template modifications. Within 7 days: Apply the vendor patch (1.8.0-beta.27 or later) to all affected instances in a staged rollout beginning with non-production environments. Within 30 days: Complete patching of all production systems and conduct a security audit of editor account permissions and recent content changes to detect potential exploitation.

Grav CVE-2025-66294

EUVD-2025-200081 HIGH

Code Injection (CWE-94)

2025-12-01 security-advisories@github.com

GHSA-662m-56v4-3r8f

RCE Code Injection Grav

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200081

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

Patch released

Mar 15, 2026 - 13:34 nvd

Patch available

PoC Detected

Dec 04, 2025 - 18:36 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 21:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.

Analysis

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Code Injection (CWE-94).

RemediationAI

A vendor patch is available — apply it immediately. Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.