CVE-2026-62668: Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCOLS or CURLOPTREDIRPROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated account with the api.webhooks.write permission can exploit it by creating or submitting a webhook URL. The issue is therefore most relevant where that permission is granted to untrusted, compromised, or overly broad user accounts.
What access can an attacker gain through a malicious webhook target?
The attacker can target private-network and link-local services, including cloud metadata endpoints, and can pivot requests to internal services. They can also use file, dict, or gopher URLs and retrieve local files and webhook delivery response bodies.
Are webhook URLs limited to HTTP and HTTPS in affected releases?
No. Before version 1.0.6, URLs receive only syntax validation through FILTER_VALIDATE_URL, while cURL has no CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. This permits unsupported-for-webhooks protocols and unrestricted redirect targets.
What version fixes the vulnerability?
Upgrade the Grav API Plugin to version 1.0.6. The issue affects versions prior to 1.0.6.