4.9

CVE-2025-66305

Exploit

Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular expression parsing error on the server. This leads to application-wide failure due to the use of the preg_match() function with an improperly constructed regular expression, resulting in an error. Once triggered, the site becomes completely unavailable to all users. This vulnerability is fixed in 1.8.0-beta.27.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getgrav ≫ Grav Version >= 1.7.48 < 1.8.0
Getgrav ≫ Grav Version 1.8.0 Update beta1
Getgrav ≫ Grav Version 1.8.0 Update beta10
Getgrav ≫ Grav Version 1.8.0 Update beta11
Getgrav ≫ Grav Version 1.8.0 Update beta12
Getgrav ≫ Grav Version 1.8.0 Update beta13
Getgrav ≫ Grav Version 1.8.0 Update beta14
Getgrav ≫ Grav Version 1.8.0 Update beta15
Getgrav ≫ Grav Version 1.8.0 Update beta16
Getgrav ≫ Grav Version 1.8.0 Update beta17
Getgrav ≫ Grav Version 1.8.0 Update beta18
Getgrav ≫ Grav Version 1.8.0 Update beta19
Getgrav ≫ Grav Version 1.8.0 Update beta2
Getgrav ≫ Grav Version 1.8.0 Update beta20
Getgrav ≫ Grav Version 1.8.0 Update beta21
Getgrav ≫ Grav Version 1.8.0 Update beta22
Getgrav ≫ Grav Version 1.8.0 Update beta23
Getgrav ≫ Grav Version 1.8.0 Update beta24
Getgrav ≫ Grav Version 1.8.0 Update beta25
Getgrav ≫ Grav Version 1.8.0 Update beta26
Getgrav ≫ Grav Version 1.8.0 Update beta3
Getgrav ≫ Grav Version 1.8.0 Update beta4
Getgrav ≫ Grav Version 1.8.0 Update beta5
Getgrav ≫ Grav Version 1.8.0 Update beta6
Getgrav ≫ Grav Version 1.8.0 Update beta7
Getgrav ≫ Grav Version 1.8.0 Update beta8
Getgrav ≫ Grav Version 1.8.0 Update beta9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.304
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-248 Uncaught Exception

An exception is thrown from a function, but it is not caught.

https://github.com/getgrav/grav/commit/ed640a13143c4177af013cf001969ed2c5e197ee
Patch
https://github.com/getgrav/grav/security/advisories/GHSA-m8vh-v6r6-w7p6
Vendor Advisory
Exploit