CVE-2026-62234: Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav CMSto a version that resolves this vulnerability.Fixed in 2.0.4 - Configuration
Update Grav so webhook dispatch restricts cURL protocols; specifically ensure file://, dict://, and gopher:// are not allowed in webhook URLs created by authenticated users with api.webhooks.write.
Grav webhook dispatch cURL protocol restrictions = restrict to permitted protocols; block file://, dict://, and gopher://
Event History
Frequently Asked Questions
What is CVE-2026-62234?
CVE-2026-62234 is a high severity vulnerability in Grav versions before 2.0.4 that allows authenticated users to exploit SSRF through unrestricted cURL protocols.
What is the severity of CVE-2026-62234?
The severity of CVE-2026-62234 is rated high with a score of 8.1 on the CVSS scale.
How is CVE-2026-62234 exploited?
CVE-2026-62234 can be exploited by authenticated users with api.webhooks.write permission to create malicious webhooks using file://, dict://, or gopher:// protocols.
How do I fix CVE-2026-62234?
To fix CVE-2026-62234, upgrade your Grav installation to version 2.0.4 or later.
What are the potential impacts of CVE-2026-62234?
The potential impacts of CVE-2026-62234 include reading local files, accessing process information, or potentially pivoting to internal resources.