CVE-2026-62668
Received Received - Intake

Stored XSS via Webhook URL in Grav API Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62668
EUVD
EUVD-2026-62538

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav_api_plugin 1.0.6
getgrav grav_cms to 2.0.3 (inc)
getgrav grav_cms 2.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Grav API Plugin for Grav CMS. It allows authenticated users with api.webhooks.write permission to submit malicious webhook URLs that bypass URL validation and cURL protocol restrictions. This enables access to local files, internal services, or cloud metadata endpoints.

Detection Guidance

Check Grav CMS and Grav API Plugin versions. Run commands like 'composer show getgrav/grav' or 'bin/grav version' to verify if versions are below 1.0.6. Inspect webhook configurations for unauthorized URLs targeting file, dict, gopher, or private-network schemes.

Impact Analysis

An attacker could read sensitive files on the server, interact with internal services like databases, or access cloud metadata endpoints. This could lead to data breaches, unauthorized system access, or pivoting to other internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Grav API Plugin to version 1.0.6 or later. Remove or restrict api.webhooks.write permissions for users. Monitor webhook logs for suspicious URLs or requests to internal/cloud endpoints. Block outbound requests to private IP ranges or unusual protocols at the firewall level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart