CVE-2025-66295: Path Traversal in getgrav/grav

The primary impact of CVE-2025-66295 lies in the ability of an attacker to write arbitrary YAML files on the server. This is achieved by injecting path traversal sequences (e.g., ..\Nijat or ../Nijat) into the username field during user creation. The attacker can then control the path where the account YAML file is written, potentially overwriting critical system configuration files like email.yaml, system.yaml, or admin.yaml. Successful exploitation could lead to unauthorized access, modification of site settings, and even complete system compromise. The ability to overwrite configuration files allows for persistent backdoors and further malicious activity. This vulnerability shares similarities with other path traversal exploits where attackers leverage directory traversal sequences to bypass access controls.

1. Reserved2025-11-26
2. Published2025-12-02
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66295 is to immediately upgrade getgrav/grav to version 1.8.0-beta.27 or later. If upgrading is not immediately feasible, consider implementing stricter input validation on the username field within the Admin UI to prevent path traversal sequences. While not a complete solution, a Web Application Firewall (WAF) could be configured to block requests containing suspicious path traversal patterns in the username parameter. Monitor system logs for unusual file creation activity, particularly in the user/accounts/ directory and other sensitive locations. After upgrading, confirm the fix by attempting to create a user with a username containing path traversal sequences and verifying that the account YAML file is not written to an unintended location.

Last updated

1.7.52recently