CVE-2026-62668 Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
An attacker with webhook write access can exploit unrestricted cURL protocols to read local files and access internal services via Server-Side Request Forgery.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62668?
CVE-2026-62668 is a critical server-side request forgery vulnerability in getgrav grav, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Weakness: CWE-918
Which versions are affected by CVE-2026-62668?
How do I fix CVE-2026-62668?
No fix has been published for CVE-2026-62668 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-62668 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62668 exists.