CVE-2025-66301

CVE-2025-66301 is a critical improper authorization vulnerability affecting Grav CMS versions prior to 1.8.0-beta.27. An authenticated editor with limited permissions can manipulate the YAML frontmatter of a page's form via a POST request, specifically the 'process' section, to alter form functionality. This allows for significant changes to how the form operates post-submission, potentially leading to further vulnerabilities. The vulnerability carries a CVSS score of 9.6 (Critical), indicating it can be exploited remotely with low attack complexity and requires only low privileges, but has a high impact on confidentiality and integrity. While not currently on CISA's KEV catalog, a Metasploit module exists for a related Twig SSTI RCE, suggesting potential for exploitation. Despite the high severity and available exploit intelligence, there is currently no public community discussion or media coverage surrounding this CVE. This suggests a low level of awareness, though the existence of a Metasploit module indicates a developed exploit.