CVE-2025-66294: 
PHP vulnerability analysis and mitigation

CVE-2025-66294 is a Server-Side Template Injection (SSTI) vulnerability in Grav, a file-based web platform, that allows authenticated attackers with editor permissions to execute arbitrary commands on the server. Under certain conditions, the vulnerability may also be exploited by unauthenticated attackers. It affects all Grav versions prior to 1.8.0-beta.27, including the 1.7.x stable branch (from 1.7.48) and all 1.8.0 beta releases up to beta.26. The vulnerability was disclosed on December 1, 2025, and carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Feedly).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336) and improper control of code generation (CWE-94), specifically in the cleanDangerousTwig method within system/src/Grav/Common/Security.php. The method used a single, insufficiently broad regex pattern that failed to account for nested function calls, allowing attackers to bypass sanitization by wrapping dangerous functions (e.g., read_file, shell_exec) inside the permitted evaluate() or evaluate_twig() Twig functions — for example, a payload like {{ evaluate("read_file('/etc/passwd')") }} would pass the filter undetected. The vulnerability is triggered when form submissions with a message process action are handled via $twig->processString(), which calls the flawed sanitizer before rendering user-controlled content as a Twig template. A chained Broken Access Control vulnerability (reported separately) further allows a user with only page permissions to modify the process section of a form by intercepting and altering the HTTP request (Github Advisory, Patch Commit).

Successful exploitation grants an attacker full remote code execution (RCE) on the server, with complete compromise of confidentiality, integrity, and availability. An authenticated editor can unconditionally take over the entire system by creating a malicious form with an injected Twig payload. In a second attack scenario, if an existing form already accepts user input and passes it through evaluate_twig, an unauthenticated guest can also achieve RCE, significantly broadening the attack surface and enabling data exfiltration, web shell deployment, and lateral movement within the hosting environment (Github Advisory).

A Metasploit module (exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce) was added to the Metasploit Framework on December 11, 2025, making weaponized exploitation readily accessible (Metasploit Module). The GitHub security advisory itself references a proof-of-concept exploit (Github Advisory). The EPSS score is approximately 0.169%, indicating a relatively low but non-negligible probability of exploitation in the wild; no confirmed in-the-wild exploitation or specific threat actor attribution has been reported as of the available data. The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing Grav installations (versions < 1.8.0-beta.27) using tools like Shodan or Censys, searching for Grav-specific HTTP headers or page signatures. Confirm the Form and Admin plugins are installed.
2. Obtain editor credentials: Authenticate as a user with editor (pages) permissions, or exploit the companion Broken Access Control vulnerability to escalate form-editing capabilities by intercepting and modifying HTTP requests.
3. Create or modify a malicious form: Navigate to the Grav Admin panel and create or edit a page containing a form with a process section using the message action. Inject a Twig SSTI payload into the message value, leveraging the evaluate() wrapper to bypass the cleanDangerousTwig regex filter, e.g.:

   process:
     message: "{{ evaluate(\"shell_exec('id')\") }}"

4. Trigger form submission: Submit the form (either as the attacker or by inducing a victim to submit it). The onFormProcess handler in form.php passes the message value through $twig->processString(), which calls the flawed cleanDangerousTwig sanitizer — the nested payload bypasses the regex and is rendered as live Twig.
5. Achieve RCE: The injected Twig expression executes arbitrary PHP/system commands on the server as the web server process user, enabling reverse shell establishment, credential harvesting, or further lateral movement.
6. Unauthenticated path: If a publicly accessible form already uses evaluate_twig on user-supplied input, submit the SSTI payload directly as a form field value without any authentication (Github Advisory, Metasploit Module).

• Network: Unusual HTTP POST requests to Grav form endpoints containing Twig template syntax (e.g., {{, {%, evaluate(, evaluate_twig() in form field values or message parameters; unexpected outbound connections from the web server process to external IPs.
• Logs: Web server access logs showing POST requests to form-handling URLs with encoded or obfuscated Twig payloads; PHP error logs referencing cleanDangerousTwig, processString, or Twig evaluation errors; admin panel logs showing unexpected form creation or modification by editor-level accounts.
• File System: Newly created or modified files in the Grav installation directory (e.g., web shells with .php extensions in user/pages/ or user/data/); unexpected cron jobs or scheduled tasks added under the web server user account.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, sh, curl, wget, python, nc) visible in process listings; unexpected network connections initiated by the web server process.

The vulnerability is fixed in Grav version 1.8.0-beta.27, which overhauls the cleanDangerousTwig method with a comprehensive multi-pass regex approach, an expanded blocklist of dangerous functions, and additional patterns to detect nested evaluation and string concatenation bypass attempts (Patch Commit, Github Advisory). Organizations should upgrade immediately. As interim mitigations: restrict editor-level permissions to trusted users only; disable or restrict the Form and Admin plugins if not required; implement WAF rules to detect and block Twig template injection patterns in HTTP request bodies; and monitor for unauthorized form modifications in the admin panel.

Rapid7 highlighted the addition of the Metasploit module for this vulnerability in their December 19, 2025 weekly wrap-up blog post, underscoring the practical exploitability of the flaw (Rapid7 Blog). Belgium's Centre for Cybersecurity (CCB) issued an advisory warning of the critical nature of the vulnerability and urging immediate patching (CCB Advisory). Community discussion was noted on Bluesky, with security researchers drawing attention to the Metasploit module release shortly after it was published.