Grav anfällig für Path Traversal / willkürliches YAML-Schreiben über Benutzererstellung, was zu Account Takeover / Systemkorruption führt

The primary impact of CVE-2025-66295 lies in the ability of an attacker to write arbitrary YAML files on the server. This is achieved by injecting path traversal sequences (e.g., ..\Nijat or ../Nijat) within the username field during user creation. The crafted username tricks the application into writing the account YAML file to an unintended location outside the user/accounts/ directory. The YAML file can contain sensitive information, including email addresses, full names, two-factor authentication secrets, and, critically, hashed passwords. Successful exploitation allows an attacker to modify site configuration files (like email.yaml, system.yaml, or admin.yaml), potentially leading to complete site compromise and data exfiltration. This vulnerability shares similarities with other path traversal exploits where attackers leverage relative paths to bypass access controls.

Sites running getgrav/grav versions 1.8.0-beta.9 and earlier are at immediate risk. Specifically, sites with publicly accessible Admin UI endpoints and those that haven't implemented robust input validation on user creation forms are particularly vulnerable. Shared hosting environments using getgrav/grav are also at increased risk due to the potential for cross-site contamination.

• php / server:

find /path/to/grav/user/accounts/ -name '*.yaml' -print0 | xargs -0 grep -i '..\\' # Search for path traversal sequences in account YAML files

• php / server:

journalctl -u grav -f | grep -i "writing account yaml file" # Monitor Grav logs for file writing activity

• generic web:

curl -I 'http://your-grav-site.com/admin/users/create?username=..%2F%2FNijat' # Check for unusual response headers or errors when attempting to create a user with a malicious username

1. 2025-12-02Disclosure

   disclosure

2. 2025-12-02Patch

   patch

1. Reserviert2025-11-26
2. Veröffentlicht2025-12-02
3. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-66295 is to immediately upgrade to getgrav/grav version 1.8.0-beta.27 or later. If upgrading is not immediately feasible, consider implementing stricter input validation on the username field within the Admin UI to prevent the injection of path traversal sequences. While not a complete solution, this can reduce the attack surface. Web Application Firewalls (WAFs) configured to detect and block requests containing path traversal patterns (e.g., ..\ or ../) can provide an additional layer of defense. Monitor system logs for suspicious file creation activity outside the expected user/accounts/ directory. There are no specific Sigma or YARA rules available at this time, but monitoring for unexpected YAML file creation is recommended.

Zuletzt aktualisiert

1.7.52kürzlich