What is the CVSS score of CVE-2025-66299?

CVE-2025-66299 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Grav are affected by CVE-2025-66299?

Grav CMS versions prior to 1.8.0-beta.27 contain a critical vulnerability allowing authenticated editors to execute arbitrary code on servers, effectively bypassing security protections.. A patch is available.

Is there a public PoC exploit available for CVE-2025-66299?

Yes, a public proof-of-concept exploit is available for CVE-2025-66299. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-66299?

Within 24 hours: Inventory all Grav CMS deployments and confirm versions; restrict editor role permissions to trusted personnel only and audit recent editor activity for suspicious template changes. Within 7 days: Apply the vendor patch to upgrade to version 1.8.0-beta.27 or later on all affected systems, testing thoroughly in non-production environments first. Within 30 days: Conduct post-patch verification, review and strengthen access controls for editor roles, and implement logging/monitoring of template modifications.

Grav CVE-2025-66299

EUVD-2025-200111 HIGH

Code Injection (CWE-94)

2025-12-01 security-advisories@github.com

GHSA-gjc5-8cfh-653x

RCE Code Injection Grav

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200111

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

Patch released

Mar 15, 2026 - 13:34 nvd

Patch available

PoC Detected

Dec 03, 2025 - 15:41 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 22:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.

Analysis

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Code Injection (CWE-94).

RemediationAI

A vendor patch is available — apply it immediately. Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.