CVE-2025-66298 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin config…
High CVSS: 7.7

CVE-2025-66298

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.
Vendor
Getgrav
Product
Grav
CWE
CWE-1336
Yayın Tarihi
2025-12-01 22:15:49
Güncelleme
2025-12-03 15:51:09
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-1336 Grav HIGH Getgrav 2025

Referanslar

https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458 https://github.com/getgrav/grav/security/advisories/GHSA-8535-hvm8-2hmv