Privilege Escalation and Remote Code Execution in Grav CMS by Grav

CVE-2025-66297

What is CVE-2025-66297?

Grav is a file-based web platform that allows users with admin panel access to create or edit pages. Prior to version 1.8.0-beta.27, a vulnerability exists where an administrator could enable Twig processing in page frontmatter. This would allow an attacker to inject malicious Twig expressions, leading to privilege escalation to admin rights and potential execution of arbitrary system commands via the scheduler API. This poses significant security risks as it enables unauthorized access and manipulation of the Grav CMS environment. The issue is addressed in the subsequent update, ensuring better protection against such exploitation.

References