CVE-2025-66844: Grav may be vulnerable to SSRF attack via Twig Templates
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.
Published Dec 15, 2025 · Updated Dec 17, 2025
Affected packages
getgrav/grav
- Ecosystem
- Composer (PHP)
- Affected
- <= 1.7.49.5
- Fixed in
- No patched version yet
- Check
composer show getgrav/grav
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
critical8.8Sep 17, 2026CVE-2026-75828
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
critical8.7Sep 17, 2026CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
critical9.1May 5, 2026CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
critical9.4May 5, 2026GHSA-vj3m-2g9h-vm4p
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
criticalMay 5, 2026