CVE-2025-66844

Critical

Published: 15/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

In grav before 1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.

Risk Assessment

The risk involves the possibility of making requests to internal network resources, potentially leading to disclosure of sensitive information or attacks on internal services.

Recommendation

Upgrade grav to version 1.7.49.5 or later and review Twig configuration to disallow registration of undefined PHP functions.

Original NVD description (English source)

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered