CVE-2025-66302

MediumCVSS 6.8/10Last modified Sep 26, 2026

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory. The impact of this vulnerability depends on the privileges of the user account running the application. This vulnerability is fixed in 1.8.0-beta.27.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-663034.9Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to th CVE-2025-663047.2Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel CVE-2025-663054.9Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu CVE-2025-663066.5Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS CVE-2025-663075.3This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663085.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663096.1This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-66317.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious a CVE-2025-663105.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663115.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663125.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663137.2ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handl