CVE-2025-66305
BaseFortify
Publication date: 2025-12-01
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getgrav | grav | From 1.7.48 (inc) to 1.8.0 (exc) |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
| getgrav | grav | 1.8.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-248 | An exception is thrown from a function, but it is not caught. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Denial of Service (DoS) issue in the Grav web platform before version 1.8.0-beta.27. It occurs in the 'Languages' submenu of the Grav admin configuration panel, where the 'Supported' parameter does not properly validate user input. If a malformed value, such as a single forward slash (/) or an XSS test string, is entered, it causes a fatal regular expression parsing error on the server. This error leads to application-wide failure, making the site completely unavailable to all users.
How can this vulnerability impact me? :
The vulnerability can cause the entire Grav site to become unavailable to all users due to a fatal error triggered by malformed input in the admin panel. This results in a Denial of Service, preventing legitimate users from accessing the site or its services.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Grav to version 1.8.0-beta.27 or later, as this version contains the fix for the Denial of Service vulnerability in the Languages submenu of the admin configuration panel.