Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
References
| Link | Resource |
|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh | Exploit Third Party Advisory |
| https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
03 Dec 2025, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:getgrav:grav:1.8.0:beta21:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta17:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta24:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta25:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta15:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta20:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta22:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta11:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta10:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta3:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta18:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta1:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta13:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta5:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta9:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta16:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta19:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta14:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta4:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta26:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta7:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta2:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta8:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta23:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta6:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta12:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
| First Time |
Getgrav
Getgrav grav |
|
| References | () https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh - Exploit, Third Party Advisory |
02 Dec 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh - |
01 Dec 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-01 22:15
Updated : 2025-12-03 15:50
NVD link : CVE-2025-66301
Mitre link : CVE-2025-66301
CVE.ORG link : CVE-2025-66301
JSON object : View
Products Affected
getgrav
- grav
CWE
CWE-285
Improper Authorization