Vulnerability Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Related Weaknesses (CWE)
References
- https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8
- https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6
- https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf
- https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf
FAQ
What is CVE-2026-62668?
CVE-2026-62668 is a documented vulnerability. Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTE...
How severe is CVE-2026-62668?
CVSS scoring is not yet available for CVE-2026-62668. Check NVD for updates.
Is there a patch for CVE-2026-62668?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.