CRITICAL🇵🇱 Wersja polska

CVE-2025-66844

CVSS 9.1v3.1pub. 2025-12-15upd. 2025-12-17

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Getgrav Grav

    APP
    Getgrav
    < 1.7.49.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRF
CWE
References

Related vulnerabilities

CVE-2021-47812CRITICAL9.3PL ✓ten sam produkt

GravCMS – nieuwierzytelniony zapis YAML i zdalne wykonanie kodu PHP

CVE-2025-46199CRITICAL9.8PL ✓ten sam produkt

XSS umożliwiający wykonanie kodu w Getgrav Grav (≤ 1.7.48)

CVE-2023-34251CRITICAL9.9ten sam produkt

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template...

CVE-2026-42844HIGH8.7ten sam produkt

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.medi...

CVE-2026-42608HIGH8.8ten sam produkt

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the F...