Executive brief
The Grav API Plugin provides REST API access to Grav CMS content. A flaw in webhook URL validation allowed users with webhook-write privileges to submit requests to arbitrary protocols (file://, dict://, gopher://) and internal network addresses, including cloud metadata endpoints. This could lead to exposure of local files, internal service enumeration, and potential credential theft from cloud environments.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in the WebhookController and WebhookDispatcher components. WebhookController.php validated webhook URLs using only PHP's FILTER_VALIDATE_URL check, which does not restrict protocol schemes. WebhookDispatcher.php initialized cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions, permitting file://, dict://, gopher://, and private/link-local network requests. An authenticated attacker with api.webhooks.write scope could submit arbitrary webhook targets, retrieve responses (including local file contents and cloud metadata), and pivot to internal services. The fix in version 1.0.6 enforces an HTTP/HTTPS allowlist, rejects private/reserved hosts at validation and again at delivery time, and restricts cURL to HTTP(S) only.
Affected products
- Grav API Plugin before 1.0.6
Timeline
- 2026-08-19: disclosed
- 2026-06-26: patched: Fix committed and released in 1.0.6