Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-62668Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Critical 9.4

In plain English

A critical-severity server-side request forgery in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.4%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	< 2.0.4
getgrav	grav-plugin-api	< 1.0.6

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6 x_refsource_MISC