8.8

CVE-2025-66299

Exploit

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getgrav ≫ Grav Version < 1.8.0
Getgrav ≫ Grav Version 1.8.0 Update beta1
Getgrav ≫ Grav Version 1.8.0 Update beta10
Getgrav ≫ Grav Version 1.8.0 Update beta11
Getgrav ≫ Grav Version 1.8.0 Update beta12
Getgrav ≫ Grav Version 1.8.0 Update beta13
Getgrav ≫ Grav Version 1.8.0 Update beta14
Getgrav ≫ Grav Version 1.8.0 Update beta15
Getgrav ≫ Grav Version 1.8.0 Update beta16
Getgrav ≫ Grav Version 1.8.0 Update beta17
Getgrav ≫ Grav Version 1.8.0 Update beta18
Getgrav ≫ Grav Version 1.8.0 Update beta19
Getgrav ≫ Grav Version 1.8.0 Update beta2
Getgrav ≫ Grav Version 1.8.0 Update beta20
Getgrav ≫ Grav Version 1.8.0 Update beta21
Getgrav ≫ Grav Version 1.8.0 Update beta22
Getgrav ≫ Grav Version 1.8.0 Update beta23
Getgrav ≫ Grav Version 1.8.0 Update beta24
Getgrav ≫ Grav Version 1.8.0 Update beta25
Getgrav ≫ Grav Version 1.8.0 Update beta26
Getgrav ≫ Grav Version 1.8.0 Update beta3
Getgrav ≫ Grav Version 1.8.0 Update beta4
Getgrav ≫ Grav Version 1.8.0 Update beta5
Getgrav ≫ Grav Version 1.8.0 Update beta6
Getgrav ≫ Grav Version 1.8.0 Update beta7
Getgrav ≫ Grav Version 1.8.0 Update beta8
Getgrav ≫ Grav Version 1.8.0 Update beta9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.447
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458
Patch
https://github.com/getgrav/grav/security/advisories/GHSA-gjc5-8cfh-653x
Third Party Advisory
Exploit