CVE-2025-66298: 
PHP vulnerability analysis and mitigation

CVE-2025-66298 is a Server-Side Template Injection (SSTI) vulnerability in Grav, a file-based PHP web platform, that allows unauthenticated remote attackers to extract the entire Grav configuration — including plugin configuration details and potentially sensitive secrets — by submitting a crafted POST payload to any page containing a simple form. The vulnerability was discovered by researcher yiannakasgeorge and disclosed on December 1, 2025, affecting Grav versions from 1.7.48 up to (but not including) 1.8.0-beta.27, including all 1.8.0 beta releases prior to beta.27. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (Github Advisory, Grav Security Advisory).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336), specifically in Grav's form processing logic. When a form submission is processed, the unique_form_id field value is rendered through the Twig template engine without adequate sanitization, allowing an attacker to inject Twig expressions such as {{var_dump(_context|slice(0,7))}} that are evaluated server-side. This grants access to the _context variable, which contains the full Grav configuration object. The fix in commit e37259527d9c1deb6200f8967197a9fa587c6458 significantly expanded the cleanDangerousTwig() function in Security.php to block a comprehensive list of dangerous Twig functions, properties (including _context), and string concatenation bypass patterns across four filtering passes (Grav Security Advisory, Grav Commit).

Successful exploitation allows an unauthenticated attacker to dump the complete Grav configuration as a PHP array, which may include API keys, database credentials, plugin secrets, internal system paths, and other sensitive configuration values. This information disclosure can serve as a stepping stone for further attacks, such as credential reuse, targeted plugin exploitation, or server-side request forgery using exposed API keys. Integrity and availability are not directly impacted by this vulnerability; the impact is confined to confidentiality (Github Advisory).

A proof-of-concept (PoC) exploit is publicly documented in the GitHub Security Advisory, making exploitation straightforward for any attacker who can reach a Grav site with a form. No authentication or special privileges are required, and the attack complexity is low. As of the disclosure date, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047% (21st percentile), indicating a currently low probability of near-term exploitation (Github Advisory, Grav Security Advisory).

1. Reconnaissance: Identify a target Grav-based website (versions 1.7.48 through 1.8.0-beta.26) that has at least one page with a form rendered using the Forms plugin (v7.4.2 or similar).
2. Identify a form: Browse the target site to locate any page with a POST form. Note the form's name (e.g., hero-form) and any field names present.
3. Craft the malicious payload: Prepare a POST request targeting the form's action URL with the following fields:
   • registration-number: d643aaaa
   • hp: vJyifp
   • form-name: hero-form
   • unique_form_id: {{var_dump(_context|slice(0,7))}}
4. Submit the request: Send the crafted POST request using a tool such as curl or Burp Suite:

   curl -X POST https://target.example.com/page-with-form \
     -d 'registration-number=d643aaaa&hp=vJyifp&form-name=hero-form&unique_form_id={{var_dump(_context|slice(0,7))}}'

5. Extract configuration data: Review the HTTP response body, which will contain a PHP var_dump output of the Grav _context variable, revealing the full configuration array including plugin settings and any embedded secrets (Grav Security Advisory).

• Network: Inbound HTTP POST requests to form-handling pages containing Twig template syntax (e.g., {{, }}, {%, %}) in the unique_form_id parameter or other form fields; requests with URL-encoded variants of %7B%7B or %7D%7D in POST body.
• Logs: Web server access logs showing POST requests to form pages with unusually long or syntactically anomalous unique_form_id values; PHP error logs referencing var_dump, _context, or Twig evaluation errors.
• Application Logs: Grav debug or error logs showing template rendering of user-supplied input containing _context, slice, or var_dump expressions.
• Response Anomalies: HTTP responses from form submission endpoints that are significantly larger than expected or contain PHP array dump output (array(N) {) in the body (Grav Security Advisory).

The vulnerability is fixed in Grav version 1.8.0-beta.27. Administrators should upgrade immediately by updating via the Grav admin panel or by pulling the latest release from the official repository. After upgrading, any secrets or API keys that may have been exposed in the configuration should be rotated. As a temporary workaround if upgrading is not immediately possible, consider disabling public-facing forms or restricting access to form-enabled pages via network controls. A comprehensive security audit of the Grav installation is also recommended to assess potential prior exposure (Grav Security Advisory, Grav Commit).

The vulnerability was published by Grav maintainer rhukster via the GitHub Security Advisory program on December 1, 2025, crediting researcher yiannakasgeorge for the discovery. The advisory was picked up by standard vulnerability aggregators including Vulners, VulDB, and CIRCL's vulnerability lookup service shortly after disclosure. No significant independent researcher commentary or broad media coverage has been identified beyond standard CVE tracking (Grav Security Advisory).