Improper Neutralization of Special Elements Used in a Template Engine in Grav CMS - CVE-2025-66294

Detailed vulnerability description

The vulnerability allows a remote user to execute arbitrary commands on the server.

The vulnerability exists due to improper neutralization of special elements used in a template engine in the cleanDangerousTwig method when processing user-supplied Twig expressions through form message handling. A remote user can submit a specially crafted Twig payload to execute arbitrary commands on the server.

Exploitation in the documented editor scenario requires the official Form and Admin plugins and was demonstrated by chaining with a separate broken access control issue to modify the form process section. It may also be exploitable without authentication if a form already exists that accepts user input and passes it through evaluate_twig.

How to mitigate CVE-2025-66294

Sources

• https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f