CVE-2025-66298: Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Summary Having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload. Sensitive information may be contained in the configuration details.
PoC Create a simple form with two fields, 'registration-number' and 'hp'. Add a submit button and set the method to POST(screenshot attached below). Form name set to 'hero-form'. Send a POST request with the following payload and you will notice a response with a php array listing the whole Grav configuration details - including plugins(screenshot attached).
registration-number:d643aaaa
hp:vJyifp
form-name:hero-form
uniqueformid:{{vardump(context|slice(0,7))}}
!Screenshot 2025-03-25 at 7 26 02 AM
!Screenshot 2025-03-25 at 7 22 58 AM
Impact Server-Side Template (SST) vulnerability. The vulnerability affects the latest Grav version as of 25th of Match 2025 (1.7.48) with all plugins installed (including forms plugin v.7.4.2) to their latest versions as well.
Other sources
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66298?
CVE-2025-66298 has a high severity rating due to its potential to expose sensitive configuration details.
How do I fix CVE-2025-66298?
You can fix CVE-2025-66298 by upgrading to Grav version 1.8.0-beta.27 or later.
What is the impact of CVE-2025-66298 on Grav?
CVE-2025-66298 allows unauthorized access to sensitive configuration details, including plugin information.
Is CVE-2025-66298 being actively exploited?
As of now, there is no public information indicating that CVE-2025-66298 is being actively exploited in the wild.
What versions of Grav are affected by CVE-2025-66298?
CVE-2025-66298 affects all versions of Grav prior to 1.8.0-beta.27.