Grav is vulnerable to a DOS on the admin panel
Summary
| CVE | CVE-2025-66303 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-12-01 22:15:49 UTC |
| Updated | 2026-09-26 00:10:00 UTC |
| Description | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quote, the application admin panel becomes non-functional, causing significant disruptions to administrative operations. The only way to recover from this issue is to manually access the host server and modify the backup.yaml file to correct the corrupted cron expression. This vulnerability is fixed in 1.8.0-beta.27. |
Risk And Classification
Primary CVSS: v3.1 4.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003870000 probability, percentile 0.301750000 (date 2026-09-27)
Problem Types: CWE-400 | CWE-400 CWE-400: Uncontrolled Resource Consumption
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 4.9 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | DECLARED | 4.9 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Getgrav | Grav | All | All | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta1 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta10 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta11 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta12 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta13 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta14 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta15 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta16 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta17 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta18 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta19 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta2 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta20 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta21 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta22 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta23 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta24 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta25 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta26 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta3 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta4 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta5 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta6 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta7 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta8 | All | All |
| Application | Getgrav | Grav | 1.8.0 | beta9 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/getgrav/grav/security/advisories/GHSA-x62q-p736-3997 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | Exploit, Third Party Advisory |
| github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7 | [email protected] | github.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.