PT-2025-48563 · Grav · Grav

Published 2025-12-01 · Updated 2025-12-02 · CVE-2025-66304

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27

Description Grav is a file-based Web platform. Users with read access to the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure could allow an attacker to gain elevated privileges if they are able to crack the password hashes.

Recommendations Update to version 1.8.0-beta.27 or later.

Exploit

Fix

LPE

Information Disclosure

Weakness Enumeration

CWE-200

CWE-201

Related Identifiers

CVE-2025-66304

GHSA-GQ3G-666W-7H85

Affected Products

Grav

References · 7

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66304.json · Exploit
• https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7 · Patch
• https://osv.dev/vulnerability/CVE-2025-66304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66304 · Security Note
• https://t.me/CVEtracker/38595 · Telegram Post
• https://twitter.com/CVEnew/status/1995611523511685445 · Twitter Post