# CVE-2025-66301: Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

Source: https://junglewise.ai/threats/cve-2025-66301-grav-is-a-file-based-web-platform-prior-to-1-8-0-beta-27-due-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01  
License: CC BY 4.0 with a link back

CVE-2025-66301 · Severity: critical · CVSS 9.6 · Published 2025-12-01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-66301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66301 being exploited in the wild.

**How severe is CVE-2025-66301?** Critical severity, with a CVSS score of 9.6, published 1 December 2025.

**Which products and versions are affected?** getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=1.8.0-beta.27.

**Is there a fix for CVE-2025-66301?** Yes. getgrav/grav (Packagist): upgrade to 1.8.0-beta.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-66301?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 1.8.0-beta.27 or later

  ```sh
  composer require getgrav/grav:^1.8.0-beta.27
  ```


## Affected products

- getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=1.8.0-beta.27

## Identifiers

- CVE-2025-66301
- GHSA-v8x2-fjv7-8hjh

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)