CVE-2025-66844

The vulnerability is triggered through Twig templates during page content processing when the application configuration allows registration of undefined PHP functions. An attacker can craft appropriate code in a Twig template that will cause the server to execute an HTTP request to internal or external network resources. No authentication or user interaction is required, meaning the exploit can be carried out remotely over the network.

An attacker can gain access to sensitive internal network infrastructure resources and manipulate network traffic generated by the server, which may lead to disclosure of sensitive data and system integrity violation.

Grav should be updated to version 1.7.49.5 or later. Additionally, it is recommended to verify the application configuration to restrict the possibility of registering undefined PHP functions in Twig templates.

Getgrav Grav in versions below 1.7.49.5