Vulnerability · Published Dec 1, 2025 · Assigned by GitHub_M
CVE-2025-66304Grav Exposes Password Hashes Leading to privilege escalation
Medium 6.2
In plain English
A medium-severity information exposure in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | getgrav/grav | 1.8.0-beta.27 | GHSA-gq3g-666w-7h85 |
Affected products (as reported)
Weakness: CWE-200, CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L