https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T12:47:26.656813+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-30350 cnvd-2025-30350 2026-10-20T12:47:26.660071+00:00 cnvd-2025-30350 https://cve.radiocsirt.org/vuln/euvd-2026-262248 EUVD-2026-262248 2026-10-20T12:47:26.660105+00:00 EUVD-2026-262248 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66300 fkie_cve-2025-66300 2026-10-20T12:47:26.660119+00:00

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.

 https://cve.radiocsirt.org/vuln/ghsa-p4ww-mcp9-j6f2 GHSA-p4ww-mcp9-j6f2 — Grav is vulnerable to Arbitrary File Read 2026-10-20T12:47:26.660149+00:00

Affected: Packagist: getgrav/grav

### Summary

- A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. - This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token. - This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.

### Details _The vulnerability can be found in /user/plugins/form/templates/forms/fields/display/display.html.twig_ ![image](https://github.com/getgrav/grav/assets/28057767/953dbdf1-310f-4c8e-866c-8470d70cc11d)

### PoC 1. This PoC was conducted on Grav CMS version 1.7.46 and Admin Plugin version 1.10.46 ![image](https://github.com/getgrav/grav/assets/28057767/6c8607d6-cea3-4699-8a5a-8a04d047676f)

2. go to “http://grav.local/admin/pages” then create new page with “Page Template” option set to “Form”. ![image](https://github.com/getgrav/grav/assets/28057767/451fe8bc-2e2e-4f8a-a548-385aca6d5504)

3. Then go to “Expert” and on Frontmatter input box used to following form template.

![image](https://github.com/getgrav/grav/assets/28057767/9e44758a-021a-45fd-9e26-03abbf8095ef)

4. Save page and go the preview or published page you will see the content of “/etc/passwd” file on the server. ![image](https://github.com/getgrav/grav/assets/28057767/94dc2363-10e1-4e74-81e4-6c7a09db4dff)

### Impact This can allow a…