CVE-2025-66301 Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
An editor can bypass authorization checks to modify form processing actions, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66301?
CVE-2025-66301 is a high-severity missing authorization vulnerability in Getgrav Grav, published on 1 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
Weakness: CWE-285
Which versions are affected by CVE-2025-66301?
2 open source packages ship an affected version, including getgrav/grav. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 1.8.0-beta.27 |
getgrav/grav Packagist | All versions | 1.8.0-beta.27 |
Products include Getgrav Grav.
How do I fix CVE-2025-66301?
Upgrade getgrav/grav to 1.8.0-beta.27 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-66301 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66301 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Getgrav Grav
- CVE-2023-34251 Grav Server Side Template Injection vulnerability
- CVE-2025-46199 Cross-site scripting in n/a
- CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
- CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates
- CVE-2022-2073 Code Injection in getgrav/grav
Sources
Also known as GHSA-v8x2-fjv7-8hjh.