CVE-2025-66298
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
描述
### Summary Having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload. Sensitive information may be contained in the configuration details. ### PoC Create a simple form with two fields, 'registration-number' and 'hp'. Add a submit button and set the method to POST(screenshot attached below). Form name set to 'hero-form'. Send a POST request with the following payload and you will notice a response with a php array listing the whole Grav configuration details - including plugins(screenshot attached). registration-number:d643aaaa hp:vJyifp __form-name__:hero-form __unique_form_id__:{{var_dump(_context|slice(0,7))}}   ### Impact Server-Side Template (SST) vulnerability. The vulnerability affects the latest Grav version as of 25th of Match 2025 (1.7.48) with all plugins installed (including forms plugin v.7.4.2) to their latest versions as well.
如何修補 CVE-2025-66298
要修補 CVE-2025-66298,請將受影響套件升級到下列已修補版本。
- —升級至 1.8.0-beta.27 或更新版本
CVE-2025-66298 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1.8.0-beta.27
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |