CVE-2026-62668

UNKNOWN 0.0

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.

CWE	CWE-918
Vendor	getgrav
Product	grav
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new unknown vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getgrav / grav

< 2.0.4

getgrav / grav-plugin-api

< 1.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf github.com: https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e github.com: https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6