CVE-2025-66298

HighCVSS 7.5/10Last modified Sep 26, 2026

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1336

Affected software

No affected versions have been published.

Timeline

Published
Dec 1, 2025
Last modified
Sep 26, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-662998.8Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows anyCVE-2025-663008.5Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server fileCVE-2025-663019.6Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST reqCVE-2025-663026.8Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authentiCVE-2025-663034.9Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to thCVE-2025-663047.2Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel CVE-2025-663054.9Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenuCVE-2025-663066.5Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMSCVE-2025-663075.3This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-663085.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-663096.1This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-66317.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious a
CVE-2025-66298: High severity, CVSS 7.5 | Vulnix