8.8

CVE-2025-66295

Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret, and hashed_password. This vulnerability is fixed in 1.8.0-beta.27.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getgrav ≫ Grav Version >= 1.7.49.5 < 1.8.0
Getgrav ≫ Grav Version 1.8.0 Update beta1
Getgrav ≫ Grav Version 1.8.0 Update beta10
Getgrav ≫ Grav Version 1.8.0 Update beta11
Getgrav ≫ Grav Version 1.8.0 Update beta12
Getgrav ≫ Grav Version 1.8.0 Update beta13
Getgrav ≫ Grav Version 1.8.0 Update beta14
Getgrav ≫ Grav Version 1.8.0 Update beta15
Getgrav ≫ Grav Version 1.8.0 Update beta16
Getgrav ≫ Grav Version 1.8.0 Update beta17
Getgrav ≫ Grav Version 1.8.0 Update beta18
Getgrav ≫ Grav Version 1.8.0 Update beta19
Getgrav ≫ Grav Version 1.8.0 Update beta2
Getgrav ≫ Grav Version 1.8.0 Update beta20
Getgrav ≫ Grav Version 1.8.0 Update beta21
Getgrav ≫ Grav Version 1.8.0 Update beta22
Getgrav ≫ Grav Version 1.8.0 Update beta23
Getgrav ≫ Grav Version 1.8.0 Update beta24
Getgrav ≫ Grav Version 1.8.0 Update beta25
Getgrav ≫ Grav Version 1.8.0 Update beta26
Getgrav ≫ Grav Version 1.8.0 Update beta3
Getgrav ≫ Grav Version 1.8.0 Update beta4
Getgrav ≫ Grav Version 1.8.0 Update beta5
Getgrav ≫ Grav Version 1.8.0 Update beta6
Getgrav ≫ Grav Version 1.8.0 Update beta7
Getgrav ≫ Grav Version 1.8.0 Update beta8
Getgrav ≫ Grav Version 1.8.0 Update beta9
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.422
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://github.com/getgrav/grav/commit/3462d94d575064601689b236508c316242e15741
Patch
https://github.com/getgrav/grav/security/advisories/GHSA-h756-wh59-hhjv
Vendor Advisory