CVE-2026-62668

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.

CVSS

No CVSS.

References

Link	Resource
https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e
https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6
https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf
https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El plugin Grav API es una API RESTful para Grav CMS que proporciona acceso headless completo al contenido de su sitio. Antes de la versión 1.0.6, el plugin Grav API WebhookController.php acepta URLs de webhook después de solo una validación de sintaxis FILTER_VALIDATE_URL, y WebhookDispatcher.php inicializa cURL sin las restricciones CURLOPT_PROTOCOLS o CURLOPT_REDIR_PROTOCOLS. Una cuenta con api.webhooks.write puede enviar objetivos de tipo file, dict, gopher, private-network o link-local, recuperar archivos locales y cuerpos de respuesta de entrega, y pivotar solicitudes a servicios internos o a puntos finales de metadatos en la nube. Este problema está solucionado en la versión 1.0.6.

Information

Published : 2026-08-19 16:18

Updated : 2026-10-26 11:10

NVD link : CVE-2026-62668

Mitre link : CVE-2026-62668

CVE.ORG link : CVE-2026-62668

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-62668", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62668", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T18:43:58.407223Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 2.0.4"}]}, {"vendor": "getgrav", "product": "grav-plugin-api", "versions": [{"status": "affected", "version": "< 1.0.6"}]}]}], "published": "2026-08-19T16:18:19.317", "references": [{"url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e", "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf", "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6."}, {"lang": "es", "value": "El plugin Grav API es una API RESTful para Grav CMS que proporciona acceso headless completo al contenido de su sitio. Antes de la versi\u00f3n 1.0.6, el plugin Grav API WebhookController.php acepta URLs de webhook despu\u00e9s de solo una validaci\u00f3n de sintaxis FILTER_VALIDATE_URL, y WebhookDispatcher.php inicializa cURL sin las restricciones CURLOPT_PROTOCOLS o CURLOPT_REDIR_PROTOCOLS. Una cuenta con api.webhooks.write puede enviar objetivos de tipo file, dict, gopher, private-network o link-local, recuperar archivos locales y cuerpos de respuesta de entrega, y pivotar solicitudes a servicios internos o a puntos finales de metadatos en la nube. Este problema est\u00e1 solucionado en la versi\u00f3n 1.0.6."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}