CVE-2025-66844

Critical CVSS: 9.1

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

Vendor

Getgrav

Product

Grav

CWE

CWE-918

Yayın Tarihi

2025-12-15 16:15:53

Güncelleme

2025-12-17 15:38:46

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-918 Grav CRITICAL Getgrav 2025

Referanslar

https://github.com/Yohane-Mashiro/grav_cve/issues/2

Benzer Kayıtlar

High

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the a…

Critical

CVE-2021-47812

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configurat…

Medium

CVE-2025-66843

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An…

Medium

CVE-2025-65186

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page con…

Medium

CVE-2025-66312

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create…

Medium

CVE-2025-66310

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create…