CVE-2025-66295

Executive Summary

CVE-2025-66295 is a critical path traversal vulnerability in Grav, a file-based Web platform. An authenticated attacker with user creation privileges can supply a username containing path traversal sequences (e.g., ../Nijat) during new user creation via the Admin UI. This causes Grav to write the account YAML file to an unintended directory outside user/accounts/. The written YAML file may contain sensitive account fields such as email, fullname, twofa_secret, and hashed_password. The vulnerability is fixed in version 1.8.0-beta.27.

Supply Chain & Package Security

Grav is a PHP-based CMS distributed as a standalone package. The vulnerability exists in the core user management module. No third-party package dependencies are directly affected, but the integrity of the Grav installation itself is compromised if exploited.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (user creation privilege)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high privileges required reduce the attack surface, but the impact is severe due to potential credential theft and system compromise.

Deep Dive & Mechanics

The vulnerability resides in the user creation functionality of Grav's Admin UI. When a new user is created, the application constructs a file path for the account YAML file using the username. The username is not sanitized for path traversal sequences. An attacker can supply a username like ../Nijat, which causes the path to resolve to a directory outside the intended user/accounts/ folder. The YAML file is then written to that arbitrary location, containing sensitive data such as the hashed password and two-factor authentication secret.

The vulnerable code likely uses string concatenation or a similar method to build the file path without proper validation. The fix in version 1.8.0-beta.27 sanitizes the username to remove path traversal sequences.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$username = $_POST['username']; // e.g., "../Nijat"
$filePath = "user/accounts/" . $username . ".yaml";
file_put_contents($filePath, $yamlContent);

Patched Code (Conceptual):

$username = $_POST['username'];
// Sanitize username to prevent path traversal
$username = basename($username); // Removes directory components
$filePath = "user/accounts/" . $username . ".yaml";
file_put_contents($filePath, $yamlContent);

The patched version uses basename() to strip any directory traversal sequences, ensuring the username is treated as a single filename component.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Access to Grav Admin UI with a user account that has user creation privileges.
2. Steps:
   • Log in to the Grav Admin panel.
   • Navigate to the user creation page.
   • In the username field, enter a path traversal payload such as ../Nijat.
   • Fill in other required fields (email, password, etc.).
   • Submit the form.
   • The account YAML file will be written to a directory outside user/accounts/, e.g., user/../Nijat.yaml which resolves to Nijat.yaml in the Grav root.
3. Outcome: The attacker can retrieve the YAML file containing sensitive data, including the hashed password and 2FA secret.

Blue Team

1. Detection: Monitor file system writes to unexpected locations. Look for YAML files created outside the user/accounts/ directory.
2. Prevention: Implement strict input validation for usernames. Use a whitelist of allowed characters (e.g., alphanumeric and underscores). Apply the principle of least privilege to user creation roles.
3. Response: If exploitation is detected, immediately revoke the compromised user's privileges, rotate all credentials, and investigate for further compromise.

Indicators of Compromise (IOCs)

• File System Anomalies: YAML files appearing in directories outside user/accounts/, such as the Grav root or user/ directory.
• Suspicious Usernames: Usernames containing path traversal sequences like ../, ..\\, or absolute paths.
• Log Entries: Admin UI logs showing user creation with unusual usernames.
• Network Traffic: POST requests to /admin/user with username parameters containing traversal sequences.

Detection Engineering

YARA Rule

rule CVE_2025_66295_Grav_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Grav user creation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66295"
    strings:
        $traversal = /\.\.\/[a-zA-Z0-9_]+/
        $yaml_write = /file_put_contents.*user\/accounts/
    condition:
        $traversal and $yaml_write
}

Sigma Rule

title: Grav User Creation Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Grav user creation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: /admin/user*
        cs-username: '*../*'
    condition: selection
falsepositives:
    - Legitimate use of dots in usernames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66295 Grav User Creation Path Traversal";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/user"; http_uri;
    content:"username"; nocase; http_client_body;
    pcre:"/\.\.\/[a-zA-Z0-9_]+/R";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade to Grav version 1.8.0-beta.27 or later.
2. Workaround: If upgrade is not possible, restrict user creation privileges to trusted administrators only. Implement a web application firewall (WAF) rule to block usernames containing ../ or ..\\.
3. Long-term: Conduct a code review of all user input handling to ensure proper sanitization. Implement automated security testing for path traversal vulnerabilities.

Valters IT
Securing Digital Frontiers