Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
References
| Link | Resource |
|---|---|
| https://github.com/getgrav/grav/commit/ed640a13143c4177af013cf001969ed2c5e197ee | Patch |
| https://github.com/getgrav/grav/security/advisories/GHSA-p4ww-mcp9-j6f2 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
03 Dec 2025, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/getgrav/grav/commit/ed640a13143c4177af013cf001969ed2c5e197ee - Patch | |
| References | () https://github.com/getgrav/grav/security/advisories/GHSA-p4ww-mcp9-j6f2 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:getgrav:grav:1.8.0:beta21:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta17:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta24:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta25:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta15:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta20:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta22:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta11:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta10:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta3:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta18:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta1:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta13:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta5:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta9:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta16:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta19:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta14:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta4:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta26:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta7:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta2:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta8:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta23:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta6:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.8.0:beta12:*:*:*:*:*:* |
|
| First Time |
Getgrav
Getgrav grav |
01 Dec 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-01 22:15
Updated : 2025-12-03 15:45
NVD link : CVE-2025-66300
Mitre link : CVE-2025-66300
CVE.ORG link : CVE-2025-66300
JSON object : View
Products Affected
getgrav
- grav
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')