What’s Vulnerable › Vulnerabilities

CVE-2025-66304: Grav Exposes Password Hashes Leading to privilege escalation

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-01 · updated 2026-09-26
• Weakness: CWE-200

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

Affected products

• getgrav grav: from 1.7.46 before 1.8.0; 1.8.0-beta1, 1.8.0-beta10, 1.8.0-beta11, 1.8.0-beta12, 1.8.0-beta13, 1.8.0-beta14 (+20) — fixed in 1.8.0

How to fix

Upgrade to a fixed version: getgrav grav 1.8.0. Check the vendor advisory for mitigations.

References

• https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7
• https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85
• https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85

Get alerted when CVE-2025-66304 or the next vulnerability affects your stack