CVE-2025-66304: Getgrav Grav Information Disclosure Flaw

CVE-2025-66304 Overview

CVE-2025-66304 is a high-severity information disclosure vulnerability in Grav CMS, a popular file-based Web platform. The vulnerability exists in versions prior to 1.8.0-beta.27 and allows users with read access to the user account management section of the admin panel to view password hashes of all users, including administrator accounts. This sensitive data exposure can potentially lead to privilege escalation if an attacker successfully cracks these password hashes.

Critical Impact

Exposure of password hashes for all users including administrators enables potential privilege escalation through offline password cracking attacks, compromising the entire Grav CMS installation.

Affected Products

• Grav CMS versions prior to 1.8.0-beta.27
• Grav CMS 1.8.0-beta1 through 1.8.0-beta26
• All stable Grav CMS releases before the security patch

Discovery Timeline

• 2025-12-01 - CVE-2025-66304 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-66304

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in the user account management functionality within the Grav CMS admin panel. When users with read access permissions navigate to the user management section, the application improperly exposes password hashes in the response data, making them accessible to authenticated users who should not have visibility into such sensitive authentication credentials.

The CVSS v3.1 score is 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating:

• Attack Vector: Network-based exploitation
• Attack Complexity: Low - straightforward to exploit
• Privileges Required: High - requires admin panel access with read permissions
• User Interaction: None required
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The EPSS (Exploit Prediction Scoring System) score is 0.051% with a percentile of 16.05, indicating a relatively low probability of exploitation in the wild at this time.

Root Cause

The root cause of this vulnerability lies in improper access control and data filtering within the Grav CMS admin panel. The user management functionality fails to properly sanitize or redact sensitive authentication data when rendering user account information. Password hashes, which should never be exposed to any user regardless of their privilege level, are included in the response data served to users with read access to the user management section.

This represents a fundamental violation of the principle of least privilege, where sensitive cryptographic material (password hashes) is unnecessarily exposed through the application interface.

Attack Vector

The attack vector for CVE-2025-66304 involves the following exploitation path:

1. Initial Access: An attacker gains authenticated access to the Grav CMS admin panel with at least read permissions on the user account management section
2. Data Extraction: The attacker navigates to the user management interface where password hashes for all users are visible
3. Offline Cracking: The extracted password hashes are subjected to offline password cracking techniques using tools like Hashcat or John the Ripper
4. Privilege Escalation: If the administrator password hash is successfully cracked, the attacker can authenticate as the admin user and gain full control of the Grav CMS installation

The attack requires no user interaction and can be executed over the network by any authenticated user with the appropriate read permissions. The vulnerability does not require any special tools beyond standard web browsing capabilities for the initial data extraction phase.

Detection Methods for CVE-2025-66304

Indicators of Compromise

• Unusual access patterns to the user management section of the Grav admin panel
• Multiple failed login attempts followed by successful admin authentication from different IP addresses
• Log entries showing access to user account data by non-administrative users
• Evidence of password hash extraction in web server access logs

Detection Strategies

Organizations can detect potential exploitation of this vulnerability through several methods:

Log Analysis: Monitor Grav CMS and web server access logs for requests to the user management endpoint (/admin/users or similar paths). Identify patterns where users with limited privileges repeatedly access user management functionality.

Authentication Monitoring: Implement monitoring for authentication anomalies, particularly successful administrator logins from unexpected locations or IP addresses following periods of access to user management by lower-privileged accounts.

Version Detection: Identify all Grav CMS installations in your environment and verify they are running version 1.8.0-beta.27 or later. Any installation running an earlier version should be flagged for immediate patching.

Monitoring Recommendations

• Enable verbose logging for all Grav CMS admin panel access
• Implement alerting for access to user management sections by non-administrator users
• Deploy web application firewalls (WAF) to monitor and log requests to sensitive admin endpoints
• Configure SentinelOne Singularity Platform to monitor web application processes for suspicious data access patterns
• Establish baseline access patterns to the admin panel to identify anomalous behavior

How to Mitigate CVE-2025-66304

Immediate Actions Required

• Upgrade Grav CMS to version 1.8.0-beta.27 or later immediately
• Audit all user accounts with admin panel access and revoke unnecessary permissions
• Force password resets for all users, particularly administrator accounts
• Review access logs to determine if password hashes may have been exposed prior to patching

Patch Information

The vulnerability is fixed in Grav CMS version 1.8.0-beta.27. The security patch is available through the official Grav GitHub repository:

• Patch Commit:9d11094e4133f059688fad1e00dbe96fb6e3ead7
• Security Advisory:GHSA-gq3g-666w-7h85

Organizations should prioritize applying this patch as the vulnerability has a high CVSS score and could lead to complete system compromise through privilege escalation.

Workarounds

If immediate patching is not possible, implement the following temporary mitigations:

# Restrict admin panel access to trusted IP addresses only via .htaccess
# Add to your Grav admin directory
<Directory "/path/to/grav/user/plugins/admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>

Additional workarounds include:

• Restrict read access to the user management section to only essential administrator accounts
• Implement network-level access controls to limit admin panel accessibility
• Enable multi-factor authentication for all admin panel users to reduce the impact of potential password compromise
• Consider temporarily disabling the admin panel until patching can be completed