CVE-2025-66301 is a broken access control flaw in Grav, the file-based web platform. An editor limited to basic page content can alter the form process section through the admin pages endpoint, changing what happens on submission. Fixed in 1.8.0-beta.27. The record scores it 9.6, the advisory says High.
What's affected
- Product: Grav CMS with the Admin and Form plugins.
- Affected per the record: versions before 1.8.0-beta.27.
- Affected per the advisory: it lists version 1.7.48 specifically, with the patched version 1.8.0-beta.27.
- Fixed: 1.8.0-beta.27, which is a beta release.
- Required access: an account with permission to edit pages (an editor).
Sources differ. The record says "prior to 1.8.0-beta.27" while the advisory lists 1.7.48 as the affected version. Treat every release before the fixed beta as in scope until the project says otherwise. On severity, the record is 9.6 (critical) and the advisory is High.
How to check if you're exposed
Find your Grav version in the Admin panel dashboard or from the file system.
grep -r "GRAV_VERSION" system/defines.php
If it is lower than 1.8.0-beta.27, you are in the range. Then list who has page editing rights. In the Admin panel, review Accounts and check which users hold admin.pages or similar permissions, and whether any are external contributors or shared accounts.
What to do now
- Upgrade Grav to 1.8.0-beta.27 or later. Because the fix is in a beta, test the upgrade in staging, and ask the project for guidance if you cannot run a beta in production.
- Until then, reduce the number of accounts that can edit pages, and remove stale editors.
- Review form definitions in your pages. Look for process actions, redirects, email actions or template settings that your team did not write.
- Check page revision history and file timestamps for form front matter changes by editor accounts.
- Review the plugins and libraries around your CMS. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory shows the server accepting changes to a field that the editor interface did not let that user edit. The check was done in the interface, but the POST handler did not enforce the same rule. That is CWE-285, improper authorization. The advisory says the impact is changing submission logic, such as redirects, email sending and templates, and potentially breaking out of the Twig sandbox.
This is a reminder that hiding a field in a form is not an access control. The server has to check every field on every request. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Quick check
Do I need admin rights to abuse this?
No. The advisory describes an editor with permission to edit pages, not a full administrator.
Is there a stable release with the fix?
The advisory names 1.8.0-beta.27 as the patched version. Check the project releases for any newer build.
Sources
Last reviewed: 18 October 2026.
