CVE-2025-66844Critical· 9.1▾ MidnightIn grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered
grav < 1.7.49.5Upgrade past the affected range:
grav 1.7.49.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117604High· 7.5Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
CVE-2026-116019High· 8.8Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
CVE-2026-114657Medium· 5.7Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
CVE-2026-114660Medium· 6.3Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
CVE-2026-112782High· 7.5Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2026-112780High· 8.8Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@