CVE-2025-66304 MEDIUM

CVE-2025-66304: Grav Exposes Password Hashes Leading to privilege escalation

Vendor Getgrav
Product grav
Weakness CWE-200 · Info exposure
Published December 1, 2025
Last update December 2, 2025
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
December 2, 2025 Record updated