# CVE-2025-66312: Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]

Source: https://junglewise.ai/threats/cve-2025-66312-this-admin-plugin-for-grav-is-an-html-user-interface-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01  
License: CC BY 4.0 with a link back

CVE-2025-66312 · Severity: medium · CVSS 5.4 · Published 2025-12-01

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 1.11.0-beta.1.

Technologies: [Getgrav Grav-Plugin-Admin](https://junglewise.ai/threats/technologies/grav-plugin-admin), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Getgrav](https://junglewise.ai/threats/vendors/getgrav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-66312 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66312 being exploited in the wild.

**How severe is CVE-2025-66312?** Medium severity, with a CVSS score of 5.4, published 1 December 2025.

**Which products and versions are affected?** getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=1.8.0-beta.27.

**Is there a fix for CVE-2025-66312?** Yes. getgrav/grav (Packagist): upgrade to 1.8.0-beta.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-66312?** Check whether you run Getgrav Grav-Plugin-Admin or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 1.8.0-beta.27 or later

  ```sh
  composer require getgrav/grav:^1.8.0-beta.27
  ```


## Affected products

- Getgrav Grav-Plugin-Admin
- getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=1.8.0-beta.27

## Identifiers

- CVE-2025-66312
- GHSA-rmw5-f87r-w988

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)