---
id: CVE-2025-66304
title: Grav is a file-based Web platform
summary: >-
  Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read
  access on the user account management section of the admin panel can view the
  password hashes of all users, including the admin user. This exposure can
  potentiall…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-200
  - CWE-201
vendor: getgrav
product: grav
affected:
  - 'grav >= 1.7.46, < 1.8.0'
  - grav = 1.8.0
patched:
  - grav 1.8.0
published: '2025-12-01'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T00:10:00.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66304'
references:
  - url: >-
      https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7
    label: security-advisories@github.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85'
    label: security-advisories@github.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0041
epssPercentile: 0.32549
ingestedAt: '2026-09-26T00:22:39.992Z'
---

## Overview

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

## Affected

- `grav >= 1.7.46, < 1.8.0`
- `grav = 1.8.0`

## Remediation

Upgrade past the affected range:

- `grav 1.8.0`