CVE-2025-66304
published 2025-12-01CVE-2025-66304: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the…
PriorityP347high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.36%
27.8th percentile
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 1.8.0-beta.27 | 1.8.0-beta.27 |
| getgrav | grav | — | — |
| getgrav | grav | >= 0 < 1.8.0-beta.27 | 1.8.0-beta.27 |
| getgrav | grav | >= 1.7.46 < 1.8.0 | 1.8.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav Exposes Password Hashes Leading to privilege escalation
ghsa·2025-12-02
CVE-2025-66304 [MEDIUM] CWE-200 Grav Exposes Password Hashes Leading to privilege escalation
Grav Exposes Password Hashes Leading to privilege escalation
# Exposure of Password Hashes Leading to privilege escalation
**Severity Rating:** Medium
**Vector:** Privilege Escalation
**CVE:** XXX
**CWE:** 200 - Exposure of Sensitive Information
**CVSS Score:** 6.2
**CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
## Analysis
It was observed that if a users is given read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes.
An attacker with read access can:
* View and potentially crack the password hashes.
* Gain administrative access by cracking the admin password hash.
* Escalate pri
OSV
Grav Exposes Password Hashes Leading to privilege escalation
osv·2025-12-02
CVE-2025-66304 [MEDIUM] Grav Exposes Password Hashes Leading to privilege escalation
Grav Exposes Password Hashes Leading to privilege escalation
# Exposure of Password Hashes Leading to privilege escalation
**Severity Rating:** Medium
**Vector:** Privilege Escalation
**CVE:** XXX
**CWE:** 200 - Exposure of Sensitive Information
**CVSS Score:** 6.2
**CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
## Analysis
It was observed that if a users is given read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes.
An attacker with read access can:
* View and potentially crack the password hashes.
* Gain administrative access by cracking the admin password hash.
* Escalate pri
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-01
Published