CVE-2025-66297High· 8.8▾ TwilightGrav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
grav < 1.8.0grav = 1.8.0Upgrade past the affected range:
grav 1.8.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66299High· 8.8Grav is a file-based Web platform
CVE-2025-66298High· 7.5Grav is a file-based Web platform
CVE-2025-66294High· 8.8Grav is a file-based Web platform
CVE-2026-100667Medium· 5.3grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode
CVE-2026-100668Medium· 6.5Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape
CVE-2026-100670High· 8.8Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints