CVE-2025-66304CWE-200CWE-201information-disclosure

CVE-2025-66304

Medium · published December 2, 2025

CVSS v3.1
6.2
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2025-12-02T03:15Z
Affected products (27)
ProductVersionsFixed in
getgrav/grav≥ 1.7.46, < 1.8.01.8.0
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
getgrav/gravall versions—
References (3)
https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7 · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 DEC 21:40Z
    Grav Exposes Password Hashes Leading to privilege escalation
    cvelistv5