High
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Type: advisorySources: OSV
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-66297
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:33 UTC · Revision 1
Source evidence
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
core-osv · Original sourcePublished 1 Dec 2025, 21:05 UTC
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
osv:CVE-2025-66297
Complete source record
{
"id": "e2bf1d1fa038ff2c3d15197fcc154b45bb80ba0c96c606d415b765da38fb1024",
"url": "https://osv.dev/vulnerability/CVE-2025-66297",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection",
"summary": "Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.",
"evidence": "osv:CVE-2025-66297",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-66297",
"aliases": [
"CVE-2025-66297",
"GHSA-858q-77wx-hhx6"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/getgrav/grav",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0f879bd1d44863dfcf77d7cb640dab604a0dcce2"
},
{
"fixed": "e37259527d9c1deb6200f8967197a9fa587c6458"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.8.0-beta.27"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "e37259527d9c1deb6200f8967197a9fa587c6458"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.8.0-beta.26",
"1.8.0-beta.25",
"1.8.0-beta.24",
"1.8.0-beta.23",
"1.8.0-beta.22",
"1.8.0-beta.21",
"1.8.0-beta.20",
"1.8.0-beta.19",
"1.8.0-beta.18",
"1.8.0-beta.17",
"1.8.0-beta.16",
"1.8.0-beta.15",
"1.8.0-beta.14",
"1.8.0-beta.13",
"1.8.0-beta.12",
"1.8.0-beta.11",
"1.8.0-beta.10",
"1.8.0-beta.9",
"1.8.0-beta.8",
"1.8.0-beta.7",
"1.8.0-beta.6",
"1.8.0-beta.5",
"1.8.0-beta.4",
"1.8.0-beta.3",
"1.8.0-beta.2",
"1.8.0-beta.1",
"1.7.0-rc.20",
"1.7.0-rc.19",
"1.7.0-rc.18",
"1.7.0-rc.17",
"1.7.0-rc.15",
"1.7.0-rc.14",
"1.7.0-rc.13",
"1.7.0-rc.12",
"1.7.0-rc.10",
"1.7.0-rc.9",
"1.7.0-rc.8",
"1.7.0-rc.7",
"1.7.0-rc.6",
"1.7.0-rc.5",
"1.7.0-rc.4",
"1.7.0-rc.3",
"1.7.0-rc.2",
"1.7.0-rc.1",
"1.7.0-beta.10",
"1.7.0-beta.9",
"1.7.0-beta.8",
"1.7.0-beta.7",
"1.7.0-beta.6",
"1.7.0-beta.5",
"1.7.0-beta.4",
"1.7.0-beta.3",
"1.7.0-beta.2",
"1.7.0-beta.1",
"1.6.0-rc.4",
"1.6.0-rc.3",
"1.6.0-rc.2",
"1.6.0-rc.1",
"1.6.0-beta.8",
"1.6.0-beta.7",
"1.6.0-beta.6",
"1.6.0-beta.5",
"1.6.0-beta.2",
"1.6.0-beta.1",
"1.5.0-rc.1",
"1.5.0-beta.2",
"1.5.0-beta.1",
"1.3.0-rc.5",
"1.3.0-rc.4",
"1.3.0-rc.3",
"1.3.0-rc.1",
"1.2.0-rc.3",
"1.2.0-rc.2",
"1.2.0-rc.1",
"1.1.9-rc.3",
"1.1.9-rc.2",
"1.1.9-rc.1",
"1.1.0-rc.3",
"1.1.0-rc.2",
"1.1.0-rc.1",
"1.1.0-beta.5",
"1.1.0-beta.4",
"1.1.0-beta.3",
"1.1.0-beta.2",
"1.1.0-beta.1",
"0.9.19",
"0.9.18",
"0.9.17",
"0.9.16",
"0.9.15",
"0.9.14",
"0.9.13",
"0.9.12",
"0.9.11",
"0.9.10",
"0.9.9",
"0.9.8",
"0.9.7",
"0.9.6",
"0.9.5",
"0.9.4",
"0.9.3",
"0.9.2",
"0.9.0",
"0.8.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66297.json"
}
}
],
"modified": "2026-10-28T02:30:25.412452963Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66297.json",
"https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6",
"https://nvd.nist.gov/vuln/detail/CVE-2025-66297",
"https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1336"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66297.json"
}
},
"related_cves": [
{
"value": "CVE-2025-66297",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491922,
"published_at": "2025-12-01T21:05:44.536+00:00"
}