CVE-2025-66305: 
PHP vulnerability analysis and mitigation

CVE-2025-66305 is a Denial of Service (DoS) vulnerability in the Grav file-based web platform, specifically in the "Languages" submenu of the admin configuration panel (/admin/config/system). The Supported parameter fails to properly validate user input, allowing a malformed value (e.g., a single forward slash /) to cause a fatal regular expression parsing error via PHP's preg_match() function, rendering the entire site unavailable. It affects Grav versions prior to 1.8.0-beta.27, including all 1.7.x releases from 1.7.48 and 1.8.0 beta versions up to beta.26. Disclosed on December 1, 2025, it carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Grav Security Advisory).

The root cause is improper input validation (CWE-20) combined with an uncaught exception (CWE-248) in system/src/Grav/Common/Language/Language.php. The application dynamically constructs a regular expression in the setActiveFromUri() method using the contents of the Supported language field without sanitizing input via preg_quote() or validating against an allowlist. When a malformed value such as / is saved, it is incorporated directly into a preg_match() call, producing an invalid regex pattern and triggering a fatal E_WARNING error: preg_match(): Unknown modifier 'o' at line 244. The fix in version 1.8.0-beta.27 adds strict allowlist validation in setLanguages() (accepting only patterns matching /^[a-zA-Z]{2,3}(?:[-_][a-zA-Z0-9]{2,8})?$/) and passes a delimiter to getAvailable() for proper regex escaping (Grav Security Advisory, Patch Commit).

Successful exploitation causes an application-wide Denial of Service, making all pages — including admin and login views — completely inaccessible to all users. There is no confidentiality or integrity impact; the sole consequence is total loss of availability for the affected Grav instance. Because the error persists after the malformed configuration is saved, recovery requires direct file system access to correct the configuration, meaning the outage is not self-resolving (Grav Security Advisory).

Exploitation requires high privileges (authenticated admin panel access), limiting the attack surface to trusted or compromised administrator accounts. A proof-of-concept is publicly documented in the GitHub Security Advisory, with the payload being as simple as a single forward slash (/) submitted to the Supported field. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.044–0.065%, placing it in the 20th percentile for exploitation likelihood (Github Advisory, Grav Security Advisory).

1. Gain Admin Access: Obtain valid Grav administrator credentials through phishing, credential stuffing, or another compromise vector, then log into the Grav Admin Panel.
2. Navigate to Vulnerable Parameter: Go to Configuration → System → Languages (endpoint: /admin/config/system, submenu: Languages).
3. Inject Malformed Payload: In the Supported field, enter a malformed value such as a single forward slash (/) or an XSS test string that is not a valid language code.
4. Save Configuration: Click Save to submit the POST request to /admin/config/system with the malicious Supported parameter value.
5. Trigger DoS: The saved value is incorporated into a dynamically constructed preg_match() regex pattern without sanitization, causing a fatal E_WARNING (preg_match(): Unknown modifier 'o') in Language.php line 244.
6. Site Becomes Unavailable: All subsequent page requests — including admin, login, and public pages — throw the fatal error, rendering the entire Grav site inaccessible until the configuration is manually corrected via direct file system access (Grav Security Advisory).

• Logs: PHP error logs containing preg_match(): Unknown modifier 'o' referencing /system/src/Grav/Common/Language/Language.php at line 244; Whoops exception traces with ErrorException (E_WARNING) in Grav application logs.
• File System: Grav system configuration file (e.g., user/config/system.yaml) containing an invalid or unexpected value in the languages.supported field, such as / or special characters not matching standard language codes (e.g., en, en-US).
• Network: POST requests to /admin/config/system with a languages.supported parameter containing non-standard values (e.g., /, .*, XSS strings) in web server access logs.
• Application Behavior: Complete site unavailability with all pages returning fatal PHP errors immediately after an admin configuration save event (Grav Security Advisory).

Upgrade Grav to version 1.8.0-beta.27 or later, which introduces strict allowlist validation for language codes in setLanguages() and proper regex delimiter escaping in getAvailable() (Patch Commit). As an interim measure, restrict admin panel access to trusted personnel only and enforce the principle of least privilege for admin accounts to reduce the risk of a malicious or compromised admin triggering the vulnerability. If exploitation has already occurred, manually edit user/config/system.yaml to remove or correct the invalid languages.supported value to restore site availability (Grav Security Advisory).

The vulnerability was discovered by Marcelo Queiroz (marcelomulder) of CVE-Hunters and coordinated by nmmorette, with the advisory published by Grav maintainer rhukster on December 1, 2025. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation and automated CVE tracking feeds.