Grav 存在任意文件读取漏洞

The primary impact of CVE-2025-66300 is the potential for account compromise. An attacker exploiting this vulnerability can gain access to user account files, which contain sensitive information like hashed passwords, two-factor authentication (2FA) secrets, and password reset tokens. With access to these credentials, an attacker could reset passwords, bypass 2FA, and ultimately gain full control over user accounts within the Grav CMS installation. This could lead to data breaches, unauthorized modifications to the website, and potential defacement. The blast radius extends to all user accounts within the affected Grav CMS instance, making it a significant security risk.

Websites and applications utilizing Grav CMS versions 1.8.0-beta.9 and earlier are at risk. This includes organizations hosting Grav CMS instances on shared hosting environments, as the vulnerability allows for file access regardless of user privileges. Additionally, deployments with default configurations or those lacking robust file access controls are particularly vulnerable.

• php / server:

find /var/www/grav/user/plugins/form/templates/forms/fields/display/ -name 'display.html.twig' -print0 | xargs -0 grep -i 'frontmatter'

• php / server:

journalctl -u grav -f | grep -i "Frontmatter"

• generic web: Use curl to test for access to sensitive files. If the CMS is configured with default settings, attempt to access /grav/user/accounts/*.yaml via a browser or curl. A successful response indicates potential exploitation. • generic web: Review access logs for unusual file access patterns, particularly requests targeting files within the /grav/user/accounts/ directory.

1. 2025-12-02Disclosure

   disclosure

1. 已保留2025-11-26
2. 发布日期2025-12-02
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-66300 is to immediately upgrade Grav CMS to version 1.8.0-beta.27 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restricting access to the "Frontmatter" form or implementing stricter file access controls on the server could reduce the attack surface. Web Application Firewalls (WAFs) configured to block requests targeting sensitive files or unusual file access patterns may also provide some protection. After upgrading, verify the fix by attempting to access user account files through the "Frontmatter" form; access should be denied.

最后更新

1.7.52最近