Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)

The impact of this SSTI vulnerability is significant. An attacker exploiting this flaw can gain remote code execution (RCE) on the server hosting the Grav CMS instance. This allows them to compromise the entire system, potentially leading to data breaches, website defacement, or complete server takeover. The ability to bypass the security sandbox amplifies the risk, as attackers can execute commands that would normally be restricted. Given the potential for complete system compromise, the blast radius is substantial, impacting all data and services hosted on the affected server.

Websites and applications relying on Grav CMS, particularly those with multiple editors or users with elevated privileges, are at risk. Shared hosting environments where multiple Grav CMS instances share the same server are also particularly vulnerable, as a compromise of one instance could potentially lead to the compromise of others.

• php: Examine Grav CMS template files for suspicious code, particularly those involving user input. Look for attempts to execute arbitrary PHP code within template directives. • linux / server: Monitor system logs (e.g., /var/log/apache2/error.log, /var/log/syslog) for unusual PHP errors or command execution attempts originating from Grav CMS. • generic web: Use curl to test template endpoints with simple payloads like {{ config.system.uri_scheme }} and observe the response for unexpected output. • database (mysql): If Grav CMS uses a database, check for unusual entries or modifications in the database that could indicate an attacker has gained access and is attempting to persist malicious code.

1. 2025-12-02Disclosure

   disclosure

1. 予約済み2025-11-26
2. 公開日2025-12-02
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-66299 is to immediately upgrade Grav CMS to version 1.8.0-beta.27 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule to prevent SSTI is complex, restricting user input within templates and carefully reviewing editor permissions can reduce the attack surface. Regularly scan templates for potentially dangerous code snippets. After upgrading, verify the fix by attempting to inject a simple template payload (e.g., {{ config.system.uri_scheme }}) and confirming that it does not execute arbitrary code.

最終更新

1.7.52最近