Grav CMS CVE-2025-66844

Exploitation requires two specific conditions drawn from the description: (1) page content must be rendered through Twig (Grav's Twig-in-content / Twig page processing must be enabled), and (2) the Grav configuration must permit registration of undefined PHP functions - a non-default hardening setting. Exploitation is therefore limited to instances explicitly configured this way; default Grav installations that do not process page content through Twig or that disallow undefined PHP functions are not exploitable. A further practical limiter is the ability to place or influence the Twig-processed page content, which typically implies some authoring or configuration access despite the PR:N rating.

Signals conflict and should be weighed carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.1) describes a network-reachable, low-complexity, unauthenticated SSRF with high confidentiality and integrity impact - on paper a critical priority. However, the description constrains exploitation to two non-default preconditions: page content must be processed by Twig, and the configuration must allow undefined PHP functions to be registered. That operator-controlled, non-default configuration requirement sits in tension with the PR:N/AC:L rating, since reaching the Twig-in-page-content path typically presupposes some authoring/configuration privilege - verify the realistic privilege level with the vendor. Corroborating exploitation-likelihood data is modest: EPSS is only 0.29% (20th percentile), there is NO CISA KEV listing, and while publicly available exploit code exists (a GitHub issue PoC), POC availability is a distinct signal from active exploitation and does not indicate in-the-wild use. Net: this is a genuine SSRF worth patching, but the combination of a hardening-dependent precondition, low EPSS, and absence of KEV points to a conditionally-exploitable issue rather than a broadly wormable emergency - real priority for operators running the vulnerable Twig/PHP-function configuration, lower priority for default deployments.

On a Grav instance below 1.7.49.5 configured to allow undefined PHP functions and to process page content through Twig, an attacker who can supply or influence Twig-rendered page content embeds a template expression that drives the server to fetch an attacker-chosen URL, causing the server to issue requests to internal services or metadata endpoints and return their contents. Publicly available exploit code (referenced GitHub issue) demonstrates the SSRF vector. The real-world ease depends on whether the attacker can actually reach the Twig-processed content path without authoring privileges.