File-Based Web Platform Vulnerability in Grav Affects User Accounts

CVE-2025-66300

What is CVE-2025-66300?

Grav is a file-based web platform that enables users to create and manage their websites efficiently. However, prior to version 1.8.0-beta.27, a vulnerability existed that allowed low privilege users with page editing rights to access sensitive server files. This included the ability to read Grav user account files, which contain critical information such as hashed passwords, 2FA secrets, and password reset tokens. An attacker could exploit this vulnerability to compromise any registered user's account by either obtaining the hashed password or the password reset token, leading to unauthorized access.

References