CVE-2025-66305: Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Endpoint: admin/config/system Submenu: Languages Parameter: Supported Application: Grav v 1.7.48
---
Summary
A Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular expression parsing error on the server.
This leads to application-wide failure due to the use of the pregmatch() function with an improperly constructed regular expression, resulting in the following error:
pregmatch(): Unknown modifier 'o' File: /system/src/Grav/Common/Language/Language.php line 244
Once triggered, the site becomes completely unavailable to all users.
---
Details
- Vulnerable Endpoint: POST /admin/config/system - Submenu: Languages - Parameter: Supported
The application dynamically constructs a regular expression using the contents of the Supported field without escaping the input using pregquote() or proper validation. This allows attackers to inject invalid syntax into the regex engine, crashing the application during language resolution.
Stack trace excerpt:
Whoops \ Exception \ ErrorException (EWARNING) pregmatch(): Unknown modifier 'o' /system/src/Grav/Common/Language/Language.php244
---
Proof of Concept (PoC)
Payloads:
/
Steps to Reproduce:
1. Log into the Grav Admin Panel. 2. Navigate to: Configuration → System → Languages. 3. Locate the Supported field. 4. Insert one of the payloads above (e.g., a single slash /). 5. Click Save.
<img width="1897" height="639" alt="Pasted image 20250719183223" src="https://github.com/user-attachments/assets/d3a54a20-d30d-46c6-9015-722f80701cfb" />
1. Observe: All pages in the application begin throwing a fatal error and become inaccessible.
<img width="1802" height="998" alt="Pasted image 20250719175229" src="https://github.com/user-attachments/assets/b16750c2-507f-4c30-a9bb-d07fa92bb777" />
---
Impact
- Application-wide Denial of Service (DoS) - All login and admin views crash with the same error - Potentially exploitable by: - Admin panel users - CSRF if misconfigured
---
References
- CWE-1333: Improper Regular Expression - CWE-20: Improper Input Validation
Discoverer
Marcelo Queiroz
by CVE-Hunters
Other sources
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular expression parsing error on the server. This leads to application-wide failure due to the use of the pregmatch() function with an improperly constructed regular expression, resulting in an error. Once triggered, the site becomes completely unavailable to all users. This vulnerability is fixed in 1.8.0-beta.27.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66305?
CVE-2025-66305 is classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2025-66305?
To fix CVE-2025-66305, upgrade Grav to version 1.8.0-beta.27 or later.
What software is affected by CVE-2025-66305?
CVE-2025-66305 affects Grav versions prior to 1.8.0-beta.27.
How does CVE-2025-66305 impact users?
CVE-2025-66305 can allow an attacker to exploit the unsupported parameter in the Languages submenu, potentially causing a Denial of Service.
Is there a workaround for CVE-2025-66305?
Currently, no official workarounds are documented for CVE-2025-66305; upgrading is recommended.