External risk intelligence

Grav SSRF via Twig Template Processing

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-66844

Grav is a web-based Content Management System (CMS) designed to be deployed as a public-facing website. Because the vulnerability involves processing page content via Twig templates, an attacker can target the application's primary function—serving web pages—making it a common internet-facing web application.

Server-Side Request Forgery

Getgrav Grav

before 1.7.49.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE identifies a critical vulnerability in the Grav content management system that could allow an attacker to trick the system into making unintended requests. This could potentially lead to unauthorized access to internal resources or sensitive information. The main concern is confirming relevance and exposure.

Allows unauthorized requests through website content.
Matters for protecting internal systems and data.
Confirm relevance and exposure to internal resources.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by submitting malicious content to a Grav-powered website. If the website is configured to allow undefined PHP functions and processes page content through Twig templates, the attacker's crafted input could be used to trigger a Server-Side Request Forgery, potentially leading to unauthorized access or manipulation of internal resources.

Exposed to the network.
Malicious content processed by Twig.
Unauthorized internal access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to make the server initiate network requests to arbitrary internal or external resources when Twig templates are processed and undefined PHP functions can be registered. This could expose sensitive information or allow unauthorized actions on behalf of the server.

Server requests to unauthorized locations.
Unrestricted server-side network access.
Unauthorized server actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SSRF vulnerability in Grav impacts public-facing web applications. Teams responsible for web content management systems, application platforms, and potentially infrastructure hosting the CMS should collaborate. The first step is to identify all Grav instances, assess their reachability and business criticality, and then determine the accountable owner for remediation planning.

Application or platform teams own the issue.
Verify Twig template processing and reachability.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grav, and how is it used?

Grav is a flat-file Content Management System (CMS). Unlike traditional systems that rely on a database, it stores content in text files, making it a flexible, fast choice for building websites, blogs, or documentation platforms.

What does CVE-2025-66844 mean by SSRF?

This CVE involves Server-Side Request Forgery (CWE-918). It is a weakness where an application is tricked into making unauthorized requests to internal or external systems. In this case, the server acts as a proxy for the attacker, potentially accessing data or services that should be hidden from the public internet.

How can an attacker trigger this vulnerability?

An attacker triggers it by submitting specially crafted input that is processed by the Twig template engine. The issue specifically arises when the Grav configuration allows the registration of undefined PHP functions. If your Grav instance does not permit these specific configurations or does not process untrusted user input through Twig, it may not be susceptible.

Do I need to worry if my Grav site is internal?

According to Halo Surface Signal, Grav is typically deployed as a public-facing website, which increases the likelihood of external exploitation. While internet-facing instances are at higher risk of being targeted, any Grav instance where users can input content that gets processed by Twig requires attention to prevent the server from being misused to reach internal resources.

When should I update my Grav software?

You should prioritize updating to version 1.7.49.5 or higher immediately. As a first step, verify your site's version and check your configuration settings regarding Twig and PHP function registration. Coordinating with your web platform team to ensure all Grav instances are accounted for is the standard process for managing this risk.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.