CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Grav is vulnerable to Arbitrary File Read
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
- Record
CVE-2025-66300- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2025-200110
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
- Record
EUVD-2025-200110- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p4ww-mcp9-j6f2
Grav is vulnerable to Arbitrary File Read
Summary
- A low privilege user account with page editing privilege can read any server files using "Frontmatter" form.
- This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token.
- This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.
Details
The vulnerability can be found in /user/plugins/form/templates/forms/fields/display/display.html.twig
PoC
- This PoC was conducted on Grav CMS version 1.7.46 and Admin Plugin version 1.10.46
- go to “http://grav.local/admin/pages” then create new page with “Page Template” option set to “Form”.
- Then go to “Expert” and on Frontmatter input box used to following form template.
- Save page and go the preview or published page you will see the content of “/etc/passwd” file on the server.
Impact
This can allow a low privileged user to perform a full account takeover of other registered users including Administrators. This can also allow an adversary to read any file on the web server. And Due to insufficient permission verification , user who can write a page also can use frontmatter feature using this IDOR vulnerability PoC IDOR mention in CVE-2024-2792
- Record
GHSA-p4ww-mcp9-j6f2- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
- Record
CVE-2025-66300- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Grav is vulnerable to Arbitrary File Read
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
- Record
CVE-2025-66300- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-p4ww-mcp9-j6f2
Grav is vulnerable to Arbitrary File Read
Summary
- A low privilege user account with page editing privilege can read any server files using "Frontmatter" form.
- This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token.
- This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.
Details
The vulnerability can be found in /user/plugins/form/templates/forms/fields/display/display.html.twig
PoC
- This PoC was conducted on Grav CMS version 1.7.46 and Admin Plugin version 1.10.46
- go to “http://grav.local/admin/pages” then create new page with “Page Template” option set to “Form”.
- Then go to “Expert” and on Frontmatter input box used to following form template.
- Save page and go the preview or published page you will see the content of “/etc/passwd” file on the server.
Impact
This can allow a low privileged user to perform a full account takeover of other registered users including Administrators. This can also allow an adversary to read any file on the web server. And Due to insufficient permission verification , user who can write a page also can use frontmatter feature using this IDOR vulnerability PoC IDOR mention in CVE-2024-2792
- Record
GHSA-p4ww-mcp9-j6f2- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
getgrav/gravPackagist |
before 1.8.0-beta.27 | 1.8.0-beta.27 |
getgrav/gravPackagist |
before 1.8.0-beta.27, plus listed versions 0.8.00.9.00.9.10.9.100.9.11 Show 45 moreShow less0.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.310.9.320.9.330.9.340.9.350.9.360.9.370.9.380.9.390.9.40.9.400.9.410.9.420.9.430.9.440.9.450.9.50.9.60.9.70.9.80.9.91.0.01.0.0-rc.11.0.0-rc.2 |
1.8.0-beta.27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-66300 is a high vulnerability (CVSS 8.5) in Getgrav Grav, published December 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in getgrav/grav 1.8.0-beta.27.
References
github.com/getgrav/grav/security/advisories/GHSA-p4ww-mcp9-j6f2
nvd.nist.gov/vuln/detail/CVE-2025-66300
Left out here: 267 versions. The JSON record has them.