CVE-2025-66297 HIGH

CVE-2025-66297: Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Vendor Getgrav

Product grav

Weakness CWE-1336

Published December 1, 2025

Last update December 2, 2025

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.

Key dates

02Disclosure timeline

December 1, 2025 CVE published

December 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66297 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1336.html