Vulnerability Details CVE-2025-66305
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular expression parsing error on the server. This leads to application-wide failure due to the use of the preg_match() function with an improperly constructed regular expression, resulting in an error. Once triggered, the site becomes completely unavailable to all users. This vulnerability is fixed in 1.8.0-beta.27.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.2%
CVSS Severity
CVSS v3 Score 4.9
References
Products affected by CVE-2025-66305
-
cpe:2.3:a:getgrav:grav:1.7.48
-
cpe:2.3:a:getgrav:grav:1.7.49
-
cpe:2.3:a:getgrav:grav:1.7.49.1
-
cpe:2.3:a:getgrav:grav:1.7.49.2
-
cpe:2.3:a:getgrav:grav:1.7.49.3
-
cpe:2.3:a:getgrav:grav:1.7.49.4
-
cpe:2.3:a:getgrav:grav:1.7.49.5
-
cpe:2.3:a:getgrav:grav:1.8.0