CVE-2025-66301CRITICAL 9.6EPSS p65.0%

CVE-2025-66301CVE-2025-66301

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.

Scoring

CVSS 3.19.6 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS1.23% probability of exploitation · percentile 65.0% · 2026-06-19T12:03:05Z
Published2025-12-01
Last modified2025-12-03

Underlying weaknesses· 1

CWE-285

References

  1. https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh
  2. https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh

1

TypeTargetConfidenceTier
WeaknessImproper Authorizationcwe-2850%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-66300
CVE
CVE-2025-66297
CVE
CVE-2025-66294
CVE
CVE-2026-42608
CVE
CVE-2025-46199
CVE
CVE-2026-42611
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.