CVE-2025-66299: Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)

December 2, 2025

Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox.

References

github.com/advisories/GHSA-gjc5-8cfh-653x
github.com/getgrav/grav
github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458
github.com/getgrav/grav/security/advisories/GHSA-gjc5-8cfh-653x
nvd.nist.gov/vuln/detail/CVE-2025-66299

Code Behaviors & Features

Detect and mitigate CVE-2025-66299 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →