Detections
Analytics
SCA: security update for getgrav/grav (GHSA-p4ww-mcp9-j6f2)
high Tenable Self-Hosted Container Security Plugin ID 437165
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing
privilege can read any server files using "Frontmatter" form. This includes Grav user account files
(/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token.
This can allow an adversary to compromise any registered account by resetting a password for a user to get
access to the password reset token from the file or by cracking the hashed password. This vulnerability is
fixed in 1.8.0-beta.27. (CVE-2025-66300)
See Also
Plugin Details
Severity: High
ID: 437165
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/28/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.9
Percentile: 52.77
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:P
CVSS Score Source: CVE-2025-66300
CVSS v3
Risk Factor: High
Base Score: 8.5
Temporal Score: 7.6
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/2/2025
Vulnerability Publication Date: 12/1/2025
Reference Information
CVE: CVE-2025-66300
cwe: CWE-22