CVE-2025-66300: Grav CMS Information Disclosure Flaw

CVE-2025-66300 Overview

CVE-2025-66300 is a high-severity Path Traversal vulnerability affecting Grav, a popular file-based Web platform. This vulnerability allows low-privilege user accounts with page editing privileges to read arbitrary server files by exploiting the "Frontmatter" form functionality. The flaw enables attackers to access sensitive configuration files, including Grav user account files stored at /grav/user/accounts/*.yaml, which contain hashed passwords, two-factor authentication (2FA) secrets, and password reset tokens.

Critical Impact

Attackers with minimal privileges can extract sensitive authentication data including password hashes, 2FA secrets, and password reset tokens, enabling full account compromise of any registered user including administrators.

Affected Products

• Grav CMS versions prior to 1.8.0-beta.27
• Grav CMS 1.8.0-beta1 through 1.8.0-beta26
• All Grav installations with page editing features enabled for low-privilege users

Discovery Timeline

• 2025-12-01 - CVE-2025-66300 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-66300

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The vulnerability carries a CVSS 3.1 score of 8.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L.

The CVSS metrics indicate:

• Attack Vector (AV:N): Network-accessible, exploitable remotely
• Attack Complexity (AC:L): Low complexity, no special conditions required
• Privileges Required (PR:L): Low privileges needed (page editing capability)
• User Interaction (UI:N): No user interaction required
• Scope (S:C): Changed scope, can impact resources beyond the vulnerable component
• Confidentiality Impact (C:H): High confidentiality impact due to sensitive data exposure
• Integrity Impact (I:N): No direct integrity impact
• Availability Impact (A:L): Low availability impact

The EPSS (Exploit Prediction Scoring System) score is 0.058% with a percentile of 18.068, indicating a relatively low probability of exploitation in the wild at this time.

Root Cause

The root cause lies in insufficient input validation within the Frontmatter form processing functionality. When users with page editing privileges submit form data, the application fails to properly sanitize file path inputs, allowing path traversal sequences (such as ../) to escape the intended directory boundaries. This enables attackers to construct malicious paths that traverse up the directory structure and access files outside the web root, including sensitive YAML configuration files containing user credentials.

Attack Vector

The attack is executed through the network by authenticated users with minimal page editing privileges. An attacker exploits the Frontmatter form functionality by injecting path traversal sequences into file path parameters. This allows the attacker to read sensitive files such as user account YAML files located in /grav/user/accounts/. These files contain critical authentication data including:

1. Hashed user passwords - Can be subjected to offline cracking attacks
2. 2FA secrets - Enables bypassing two-factor authentication protections
3. Password reset tokens - Allows direct account takeover without password knowledge

The attacker can then compromise any registered account by either cracking the extracted password hashes or by initiating a password reset and using the stolen reset token to complete the process.

Detection Methods for CVE-2025-66300

Indicators of Compromise

• Unusual access patterns to user account YAML files in /grav/user/accounts/
• Web server logs showing requests containing path traversal sequences (../, ..%2F, ..%5C) in Frontmatter form submissions
• Unexpected password reset requests or successful resets for administrative accounts
• Authentication from unusual locations following suspicious page editing activity

Detection Strategies

Organizations should implement file integrity monitoring on sensitive directories, particularly /grav/user/accounts/. Web Application Firewalls (WAF) should be configured to detect and block path traversal patterns in HTTP requests. Review web server access logs for requests containing encoded or unencoded directory traversal sequences targeting the Grav admin interface. Monitor for unusual patterns of file access attempts, especially from accounts with limited privileges attempting to access configuration files.

Monitoring Recommendations

Enable verbose logging for the Grav CMS application and correlate with web server logs to identify exploitation attempts. Implement anomaly detection for user behavior, particularly focusing on page editing activities that deviate from normal patterns. Set up alerts for any access attempts to the /grav/user/accounts/ directory that do not originate from legitimate administrative processes. Consider deploying endpoint detection solutions that can identify and alert on path traversal exploitation in real-time.

How to Mitigate CVE-2025-66300

Immediate Actions Required

• Upgrade Grav CMS to version 1.8.0-beta.27 or later immediately
• Audit user accounts and remove unnecessary page editing privileges from low-trust users
• Review access logs for signs of prior exploitation and rotate all user credentials if compromise is suspected
• Implement Web Application Firewall rules to block path traversal patterns

Patch Information

The vulnerability is fixed in Grav version 1.8.0-beta.27. The patch is available in commit ed640a13143c4177af013cf001969ed2c5e197ee on the official Grav GitHub repository. Organizations should apply this update as soon as possible. The fix implements proper input validation and sanitization for file path parameters in the Frontmatter form functionality, preventing path traversal attacks.

For detailed patch information, refer to:

• GitHub Commit
• Security Advisory GHSA-p4ww-mcp9-j6f2

Workarounds

If immediate patching is not possible, consider the following temporary mitigations:

1. Restrict page editing privileges - Remove page editing capabilities from all non-essential user accounts until the patch can be applied
2. Implement WAF rules - Deploy Web Application Firewall rules to detect and block path traversal sequences in requests to the Grav admin interface
3. Network segmentation - Limit network access to the Grav administrative interface to trusted IP ranges only
4. File permission hardening - Ensure that the web server process has minimal necessary permissions and cannot read sensitive configuration files outside the web root
5. Monitor and alert - Enable enhanced logging and monitoring for any suspicious file access attempts

# Example: Restrict access to Grav admin interface by IP (Apache)
<Directory "/var/www/grav/admin">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Directory>