Grav CMS EUVD-2025-200076

Requires that the target Grav site (prior to 1.8.0-beta.27) exposes at least one form handled by the Forms plugin - the PoC uses a POST form with fields including __form-name__ and __unique_form_id__, and injects a Twig expression into a form field. No authentication and no user interaction are needed (PR:N/UI:N), and default configurations with a public form are exploitable. The practical limiting factor is that a reachable form must exist on the site; sites with no public forms are not exposed via this vector. The confirmed impact is disclosure of configuration data returned in the HTTP response.

This is a genuine, easy-to-exploit information-disclosure flaw but with confidentiality-only impact. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:N/VA:N) indicates a remote, low-complexity, unauthenticated attack against any Grav site that exposes a form, with high confidentiality impact and no integrity/availability impact - consistent with the description of dumping the full configuration via a Server-Side Template Injection payload. Exploitation status: publicly available exploit code exists (a working PoC is published in the GHSA advisory), but there is no CISA KEV listing and EPSS is very low at 0.06% (19th percentile), signaling no evidence of widespread automated exploitation to date. The signals are internally consistent (low complexity + public PoC + unauthenticated) yet the low EPSS and confidentiality-only scope temper the raw 7.7 score: this is a real priority for exposed Grav sites because the barrier to exploitation is minimal and the PoC is trivial to reproduce, but the direct blast radius is disclosure of secrets rather than code execution. Note the underlying weakness is SSTI (CWE-1336); the confirmed impact is config disclosure, but the extensive dangerous-function blocklist added in the patch (exec, eval, file operations, reflection, etc.) implies the template-injection primitive could be leveraged for broader impact including RCE if a suitable gadget exists - the assigned CVSS scores only the confirmed disclosure path.

An attacker locates any Grav-powered site with a public form and submits a crafted POST request placing a Twig expression such as {{var_dump(_context|slice(0,7))}} into a form field (e.g. __unique_form_id__). The server renders the injected template and returns the full Grav and plugin configuration - potentially including secrets, API keys, and credentials - in the response. A working proof-of-concept is publicly documented in the GitHub Security Advisory (GHSA-8535-hvm8-2hmv).