CVE-2025-66844
Critical · 9.1Grav may be vulnerable to SSRF attack via Twig Templates
CVSS
9.1
EPSS
0.3%
Published
Dec 15, 2025
CISA due date
—
The record
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | getgrav/grav | 0 | No fix |
Related vulnerabilities
- GHSA-729w-j79f-2c34 Grav may be vulnerable to SSRF attack via Twig Templates Same vulnerability
- GHSA-mh85-44c2-3m97 Grav is vulnerable to Stored XSS through authenticated user-edited content Also affects getgrav/grav
- CVE-2025-66843 Grav is vulnerable to Stored XSS through authenticated user-edited content Also affects getgrav/grav
- GHSA-cchq-397m-q2qm Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor Also affects getgrav/grav
- CVE-2025-65186 Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). Also affects getgrav/grav
- GHSA-8535-hvm8-2hmv Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms Also affects getgrav/grav
- GHSA-662m-56v4-3r8f Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass Also affects getgrav/grav
- GHSA-7g78-5g5g-mvfj Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]`… Also affects getgrav/grav