CVE-2025-66302

Executive Summary

CVE-2025-66302 is a path traversal vulnerability in Grav CMS, a file-based web platform. The flaw exists in the backup tool, where authenticated attackers with administrative privileges can read arbitrary files on the underlying server filesystem. This is due to insufficient input sanitization, allowing paths to escape the intended webroot directory. The vulnerability is fixed in version 1.8.0-beta.27. The CVSS score is 6.8 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept code or nuclei templates are available.

Supply Chain & Package Security

Grav CMS is a PHP-based application distributed via GitHub and its official website. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their Grav installation and ensure they are using the latest patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the requirement for administrative privileges. However, the impact on confidentiality is High, as an attacker can read sensitive files (e.g., configuration files, database credentials, or system files).

Deep Dive & Mechanics

The vulnerability resides in the backup functionality of Grav CMS. The backup tool allows administrators to create backups of the site. The flaw is in how user-supplied paths are handled when specifying files or directories to include in the backup. Without proper sanitization, an attacker can supply a path like ../../etc/passwd to read arbitrary files outside the webroot.

The root cause is the lack of validation or restriction on the path input. The application does not check if the resolved path is within the allowed directory (e.g., the Grav installation directory). This allows an authenticated admin to traverse the filesystem.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In backup tool, user input is used directly
$path = $_POST['backup_path'];
// No sanitization or validation
$files = new RecursiveIteratorIterator(
    new RecursiveDirectoryIterator($path)
);

Patched Code (Conceptual):

$path = $_POST['backup_path'];
// Sanitize and restrict to webroot
$realPath = realpath($path);
$webroot = realpath(GRAV_ROOT);
if (strpos($realPath, $webroot) !== 0) {
    throw new Exception('Invalid path');
}
$files = new RecursiveIteratorIterator(
    new RecursiveDirectoryIterator($realPath)
);

The patch ensures that the resolved path must start with the webroot directory, preventing traversal outside.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Grav CMS instance with admin credentials.
• The vulnerable version (prior to 1.8.0-beta.27).

Exploitation Steps:

1. Log in as an admin.
2. Navigate to the backup tool (e.g., /admin/tools/backup).
3. In the path input field, enter a traversal payload such as ../../etc/passwd.
4. Initiate the backup. The backup file will contain the contents of /etc/passwd.

Example Payload:

../../etc/passwd

Note: No public exploit code is available, but the above manual method is sufficient.

Blue Team

Detection:

• Monitor backup tool access logs for unusual path inputs (e.g., containing ..).
• Alert on backup operations that include paths outside the webroot.
• Use file integrity monitoring to detect unauthorized file reads.

Hunting:

• Search for backup files that contain system files (e.g., /etc/passwd).
• Review admin activity logs for suspicious backup requests.

Indicators of Compromise (IOCs)

• File Paths: Backup files containing paths like ../../etc/passwd or other system files.
• Log Entries: HTTP requests to /admin/tools/backup with backup_path parameter containing ...
• Network Traffic: Unusual outbound connections if the backup is exfiltrated.
• File Hashes: Backup files with unexpected content (e.g., system configuration files).

Detection Engineering

YARA Rule

rule CVE_2025_66302_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Grav CMS backup tool"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66302"
    strings:
        $traversal = ".."
        $backup_path = "backup_path"
    condition:
        $backup_path and $traversal
}

Sigma Rule

title: Grav CMS Backup Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Grav CMS backup tool
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66302
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "backup_path=.."
            - "backup_path=%2e%2e"
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66302 Grav CMS Backup Path Traversal"; flow:to_server; content:"backup_path"; http_uri; content:".."; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Update Grav CMS to version 1.8.0-beta.27 or later.
2. Workaround: If immediate upgrade is not possible, restrict access to the backup tool to trusted IPs only.
3. Input Validation: Implement strict input validation for all user-supplied paths in the backup tool.
4. Least Privilege: Ensure admin accounts are used only when necessary and monitor their activity.
5. Web Application Firewall (WAF): Deploy WAF rules to block path traversal patterns in backup tool requests.

Valters IT
Securing Digital Frontiers