Grav ist anfällig für Arbitrary File Read

The primary impact of CVE-2025-66300 is the potential for unauthorized access to sensitive user account information. An attacker exploiting this vulnerability can read Grav user account files, which contain hashed passwords, two-factor authentication (2FA) secrets, and password reset tokens. This information can be used to compromise any registered account. Attackers could reset passwords to gain access or crack the hashed passwords to obtain credentials. The blast radius extends to all users of the affected Grav CMS installations, particularly those with low-privilege user accounts that have page editing privileges. This vulnerability shares similarities with other file access vulnerabilities where improper input validation allows attackers to bypass security controls and access restricted resources.

Websites and applications utilizing Grav CMS versions 1.8.0-beta.9 and earlier are at risk. This includes organizations hosting Grav CMS instances on shared hosting environments, as the vulnerability allows for file access regardless of user privileges. Additionally, deployments with default configurations or those lacking robust file access controls are particularly vulnerable.

• php / server:

find /var/www/grav/user/plugins/form/templates/forms/fields/display/ -name 'display.html.twig' -print0 | xargs -0 grep -i 'frontmatter'

• php / server:

journalctl -u grav -f | grep -i "Frontmatter"

• generic web: Use curl to test for access to sensitive files. If the CMS is configured with default settings, attempt to access /grav/user/accounts/*.yaml via a browser or curl. A successful response indicates potential exploitation. • generic web: Review access logs for unusual file access patterns, particularly requests targeting files within the /grav/user/accounts/ directory.

1. 2025-12-02Disclosure

   disclosure

1. Reserviert2025-11-26
2. Veröffentlicht2025-12-02
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-66300 is to upgrade Grav CMS to version 1.8.0-beta.27 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict access to the 'Frontmatter' form and its associated templates to only authorized users. Implement strict file permissions on the /grav/user/accounts/ directory to prevent unauthorized access. Monitor access logs for suspicious activity related to file reads. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to detect and block requests attempting to access sensitive files. After upgrading, confirm the fix by attempting to access a user account file through the 'Frontmatter' form; access should be denied.

Zuletzt aktualisiert

1.7.52kürzlich