Critical severity · published Aug 19, 2026
CVE-2026-62668
Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
9.4
CVSS
0.4%
EPSS
No
On KEV
Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
< 2.0.4 · source: vendor
GR
grav-plugin-api · getgrav
< 1.0.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62668
github.com
https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e
github.com
https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)