CVE-2025-66304 | THREATINT

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

PUBLISHED Reserved 2025-11-26 | Published 2025-12-01 | Updated 2025-12-02 | Assigner GitHub_M

MEDIUM: 6.2CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-201: Insertion of Sensitive Information Into Sent Data

Product status

< 1.8.0-beta.27

affected

References

github.com/...v/grav/security/advisories/GHSA-gq3g-666w-7h85 exploit

github.com/...v/grav/security/advisories/GHSA-gq3g-666w-7h85

github.com/...ommit/9d11094e4133f059688fad1e00dbe96fb6e3ead7

cve.org (CVE-2025-66304)

nvd.nist.gov (CVE-2025-66304)

Download JSON