CVE-2025-66304 Grav Exposes Password Hashes Leading to privilege escalation
Attackers with admin panel read access can view password hashes, potentially leading to privilege escalation via offline cracking.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66304?
CVE-2025-66304 is a medium-severity vulnerability in Getgrav Grav, published on 1 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.
Which versions are affected by CVE-2025-66304?
2 open source packages ship an affected version, including getgrav/grav. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 1.8.0-beta.27 |
getgrav/grav Packagist | All versions | 1.8.0-beta.27 |
Products include Getgrav Grav.
How do I fix CVE-2025-66304?
Upgrade getgrav/grav to 1.8.0-beta.27 or later.
Is CVE-2025-66304 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66304 exists.
Other vulnerabilities in Getgrav Grav
- CVE-2023-34251 Grav Server Side Template Injection vulnerability
- CVE-2025-46199 Cross-site scripting in n/a
- CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
- CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates
- CVE-2022-2073 Code Injection in getgrav/grav
Sources
Also known as GHSA-gq3g-666w-7h85.