Grav is vulnerable to Arbitrary File Read
Priority HIGH 70CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed grav (getgrav): 1.8.0-beta.27getgrav/grav (Packagist): 1.8.0-beta.27
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getgrav | grav | before 1.8.0-beta.27 | 1.8.0-beta.27 | Patch available | CNA |
| — | getgrav/grav (Packagist) | before 1.8.0-beta.27 | 1.8.0-beta.27 | Patch available | GHSA-p4ww-mcp9-j6f2 |
- grav Vendorgetgrav Affected before 1.8.0-beta.27 Fixed in 1.8.0-beta.27 Patch available CNA
- getgrav/grav (Packagist) Vendor— Affected before 1.8.0-beta.27 Fixed in 1.8.0-beta.27 Patch available GHSA-p4ww-mcp9-j6f2
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* | before 1.8.0 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta1:*:*:*:*:*:* | 1.8.0 beta1 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta10:*:*:*:*:*:* | 1.8.0 beta10 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta11:*:*:*:*:*:* | 1.8.0 beta11 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta12:*:*:*:*:*:* | 1.8.0 beta12 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta13:*:*:*:*:*:* | 1.8.0 beta13 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta14:*:*:*:*:*:* | 1.8.0 beta14 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta15:*:*:*:*:*:* | 1.8.0 beta15 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta16:*:*:*:*:*:* | 1.8.0 beta16 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta17:*:*:*:*:*:* | 1.8.0 beta17 | Vulnerable | getgrav |
- cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta1:*:*:*:*:*:* Versions 1.8.0 beta1 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta10:*:*:*:*:*:* Versions 1.8.0 beta10 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta11:*:*:*:*:*:* Versions 1.8.0 beta11 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta12:*:*:*:*:*:* Versions 1.8.0 beta12 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta13:*:*:*:*:*:* Versions 1.8.0 beta13 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta14:*:*:*:*:*:* Versions 1.8.0 beta14 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta15:*:*:*:*:*:* Versions 1.8.0 beta15 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta16:*:*:*:*:*:* Versions 1.8.0 beta16 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta17:*:*:*:*:*:* Versions 1.8.0 beta17 Vulnerable ·getgrav
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getgrav:grav:1.8.0:beta18:*:*:*:*:*:* | 1.8.0 beta18 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta19:*:*:*:*:*:* | 1.8.0 beta19 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta2:*:*:*:*:*:* | 1.8.0 beta2 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta20:*:*:*:*:*:* | 1.8.0 beta20 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta21:*:*:*:*:*:* | 1.8.0 beta21 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta22:*:*:*:*:*:* | 1.8.0 beta22 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta23:*:*:*:*:*:* | 1.8.0 beta23 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta24:*:*:*:*:*:* | 1.8.0 beta24 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta25:*:*:*:*:*:* | 1.8.0 beta25 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta26:*:*:*:*:*:* | 1.8.0 beta26 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta3:*:*:*:*:*:* | 1.8.0 beta3 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta4:*:*:*:*:*:* | 1.8.0 beta4 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta5:*:*:*:*:*:* | 1.8.0 beta5 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta6:*:*:*:*:*:* | 1.8.0 beta6 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta7:*:*:*:*:*:* | 1.8.0 beta7 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta8:*:*:*:*:*:* | 1.8.0 beta8 | Vulnerable | getgrav |
| cpe:2.3:a:getgrav:grav:1.8.0:beta9:*:*:*:*:*:* | 1.8.0 beta9 | Vulnerable | getgrav |
- cpe:2.3:a:getgrav:grav:1.8.0:beta18:*:*:*:*:*:* Versions 1.8.0 beta18 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta19:*:*:*:*:*:* Versions 1.8.0 beta19 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta2:*:*:*:*:*:* Versions 1.8.0 beta2 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta20:*:*:*:*:*:* Versions 1.8.0 beta20 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta21:*:*:*:*:*:* Versions 1.8.0 beta21 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta22:*:*:*:*:*:* Versions 1.8.0 beta22 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta23:*:*:*:*:*:* Versions 1.8.0 beta23 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta24:*:*:*:*:*:* Versions 1.8.0 beta24 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta25:*:*:*:*:*:* Versions 1.8.0 beta25 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta26:*:*:*:*:*:* Versions 1.8.0 beta26 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta3:*:*:*:*:*:* Versions 1.8.0 beta3 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta4:*:*:*:*:*:* Versions 1.8.0 beta4 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta5:*:*:*:*:*:* Versions 1.8.0 beta5 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta6:*:*:*:*:*:* Versions 1.8.0 beta6 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta7:*:*:*:*:*:* Versions 1.8.0 beta7 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta8:*:*:*:*:*:* Versions 1.8.0 beta8 Vulnerable ·getgrav
- cpe:2.3:a:getgrav:grav:1.8.0:beta9:*:*:*:*:*:* Versions 1.8.0 beta9 Vulnerable ·getgrav
Remediation
- Fix · CNA grav (getgrav) Fixed in 1.8.0-beta.27
- Fix · GHSA-p4ww-mcp9-j6f2 getgrav/grav (Packagist) Fixed in 1.8.0-beta.27 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66300
- 2026-10-03 Alias added: GHSA-p4ww-mcp9-j6f2
References
More getgrav Grav vulnerabilities
- TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
- TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3
- TI-2025-41064 In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig… CVSS 3.1CRITICAL 9.1
- TI-2026-30888 Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. CVSS 4.0HIGH 8.8
- TI-2025-40773 Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS CVSS 3.1HIGH 8.8
- TI-2025-40768 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass CVSS 4.0HIGH 8.7
Sources
- CVE-2025-66300 · CVE Program
- CVE-2025-66300 · NVD
- FIRST EPSS
- GHSA-p4ww-mcp9-j6f2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences