Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

INFO

Published Date :

2025-12-01T21:40:11.511Z

Last Modified :

2025-12-02T20:15:13.071Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-66304 vulnerability.

Vendors Products
Getgrav
  • Grav
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-66304.

URL Resource
https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7 cve-icon cve-icon
https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact