CVE-2025-66844: 
PHP vulnerability analysis and mitigation

CVE-2025-66844 is a Server-Side Request Forgery (SSRF) vulnerability in Grav CMS affecting all versions prior to 1.7.49.5. The vulnerability is triggered via Twig template processing when page content is rendered by Twig and the configuration permits undefined PHP functions to be registered. It was published on December 15, 2025, with a CVSS v3.1 base score of 9.1 (Critical), reflecting network-accessible exploitation with no authentication required (Red Hat CVE, GitLab Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from insufficient restriction on server-side HTTP requests initiated through Twig template evaluation. When Grav CMS processes page content via the Twig templating engine and the configuration allows registration of undefined PHP functions, an attacker can inject crafted Twig template directives that cause the server to issue arbitrary outbound HTTP requests. The attack vector is network-based, requires no privileges or user interaction, and exploits the trust relationship between the Grav server and internal or external network resources. A proof-of-concept is publicly available on GitHub (GitHub PoC, Red Hat CVE).

Successful exploitation allows unauthenticated attackers to make unauthorized server-side network requests, potentially reaching internal services, cloud metadata endpoints, or other resources not directly accessible from the internet. The CVSS assessment assigns high confidentiality and high integrity impact, meaning attackers could retrieve sensitive internal data and potentially manipulate backend services. Availability is not directly impacted, but lateral movement to internal infrastructure and exposure of secrets (e.g., cloud credentials via metadata APIs) are realistic consequences (Red Hat CVE, Infinit Sec).

1. Reconnaissance: Identify publicly accessible Grav CMS instances running versions prior to 1.7.49.5 using tools like Shodan or Censys, searching for Grav-specific HTTP headers or default page signatures.
2. Assess Twig configuration: Determine whether the target Grav instance has Twig template processing enabled for page content and whether the configuration permits registration of undefined PHP functions (a non-default but possible configuration).
3. Craft malicious Twig payload: Construct a Twig template snippet that invokes a PHP function capable of making outbound HTTP requests (e.g., leveraging registered PHP functions such as file_get_contents or curl_exec via Twig's function registration mechanism).
4. Inject payload: Submit the crafted Twig template through an editable page, form, or content field that is subsequently rendered by the Twig engine on the server.
5. Trigger SSRF: The server processes the template and issues an HTTP request to an attacker-controlled or internal target URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or internal services).
6. Exfiltrate data: Capture the server's response — which may contain sensitive internal data, credentials, or service responses — via an attacker-controlled endpoint or by reading reflected output (GitHub PoC, Infinit Sec).

• Network: Unexpected outbound HTTP/HTTPS requests from the Grav web server process to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); outbound requests to unfamiliar external hosts initiated by the PHP/web server process.
• Logs: Web server access logs showing POST or GET requests to Grav page endpoints containing Twig syntax (e.g., {{, {%) in content parameters; PHP error logs referencing unexpected function registrations or Twig evaluation of unusual expressions.
• Process: PHP-FPM or Apache/Nginx worker processes initiating outbound socket connections to non-standard destinations; unusual curl, file_get_contents, or similar PHP function calls observed in application profiling or WAF logs.
• File System: Unexpected modifications to Grav page content files (.md files) containing embedded Twig function calls referencing network resources.

The primary remediation is to upgrade Grav CMS to version 1.7.49.5 or later, which addresses this SSRF vulnerability (GitLab Advisory). As interim workarounds, administrators should disable the registration of undefined PHP functions in Twig configuration and restrict which PHP functions are accessible within templates. Network-level egress filtering on the web server to block unauthorized outbound requests to internal subnets and cloud metadata endpoints provides an additional defensive layer. Regularly auditing Twig template configurations and page content for unexpected function registrations is also recommended (Red Hat CVE).

The vulnerability received coverage from security aggregators and was noted on Bluesky's CVE feed shortly after disclosure. Infinit Sec published a dedicated blog post analyzing the vulnerability. Red Hat and GitLab both catalogued the CVE in their advisory systems. No major vendor statements or prominent researcher commentary beyond initial disclosure have been identified at this time (Infinit Sec, Red Hat CVE).