CVE-2025-66299 is a Server-Side Template Injection vulnerability affecting Grav CMS, a file-based web platform, in versions prior to 1.8.0-beta.27. The vulnerability stems from improper control over code generation (CWE-94) and insufficient sandboxing of the Twig templating engine (CWE-1336). Authenticated users with editor-level permissions can inject malicious Twig template directives that interact directly with the Twig object, bypassing the security sandbox. This manipulation allows attackers to call methods and read or write attributes on the Twig object, including adding arbitrary functions to the safe_filters attribute, effectively circumventing sandbox restrictions. As a result, attackers can execute arbitrary code on the server, leading to full system compromise. The vulnerability requires authentication but no additional user interaction, and the attack surface includes any web page editable by an editor. The CVSS v3.1 score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and privileges required. Although no exploits are currently known in the wild, the vulnerability is critical due to the potential for remote code execution. The issue is resolved in Grav CMS version 1.8.0-beta.27, which properly enforces sandbox restrictions on the Twig object. Organizations using Grav CMS should prioritize patching and review editor permissions to mitigate risk.

For European organizations, this vulnerability poses a significant risk to web infrastructure relying on Grav CMS. Successful exploitation can lead to arbitrary code execution on web servers, resulting in data breaches, defacement, service disruption, or use of compromised servers as pivot points for further attacks. Confidential information stored or processed by the CMS can be exposed or altered, undermining data integrity and privacy compliance obligations such as GDPR. Availability may be impacted through denial-of-service or ransomware deployment. Since the vulnerability requires authenticated editor access, organizations with weak access controls or extensive editor privileges are particularly vulnerable. The risk is heightened in sectors with critical web presence such as government, finance, healthcare, and media. Additionally, the ability to bypass sandbox protections increases the likelihood of sophisticated attacks that evade detection by conventional security controls.

1. Upgrade all Grav CMS instances to version 1.8.0-beta.27 or later immediately to apply the security fix. 2. Audit and restrict editor permissions to the minimum necessary, ensuring only trusted users have editing capabilities. 3. Implement strong authentication mechanisms, such as multi-factor authentication, to reduce the risk of compromised editor accounts. 4. Monitor web server logs and CMS activity for unusual template modifications or suspicious behavior indicative of exploitation attempts. 5. Employ web application firewalls (WAFs) with custom rules to detect and block malicious Twig template injections. 6. Regularly review and harden CMS configurations, disabling unnecessary features that could be exploited. 7. Conduct security awareness training for content editors to recognize phishing and credential theft attempts. 8. Maintain regular backups of CMS content and server configurations to enable rapid recovery in case of compromise.