# CVE-2026-62668: Grav API Plugin server-side request forgery via webhook validation bypass

Source: https://junglewise.ai/threats/cve-2026-62668-grav-api-plugin-server-side-request-forgery-via-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62668 · Severity: info · CVSS 6.5 · Published 2026-08-19

The Grav API Plugin provides REST API access to Grav CMS content. A flaw in webhook URL validation allowed users with webhook-write privileges to submit requests to arbitrary protocols (file://, dict://, gopher://) and internal network addresses, including cloud metadata endpoints. This could lead to exposure of local files, internal service enumeration, and potential credential theft from cloud environments.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-62668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62668 being exploited in the wild.

**How severe is CVE-2026-62668?** Informational severity, with a CVSS score of 6.5, published 19 August 2026.

**Which products and versions are affected?** Grav API Plugin before 1.0.6.

**Is there a fix for CVE-2026-62668?** A patch was published on 2026-06-26: Fix committed and released in 1.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62668 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62668?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in the WebhookController and WebhookDispatcher components. WebhookController.php validated webhook URLs using only PHP's FILTER_VALIDATE_URL check, which does not restrict protocol schemes. WebhookDispatcher.php initialized cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions, permitting file://, dict://, gopher://, and private/link-local network requests. An authenticated attacker with api.webhooks.write scope could submit arbitrary webhook targets, retrieve responses (including local file contents and cloud metadata), and pivot to internal services. The fix in version 1.0.6 enforces an HTTP/HTTPS allowlist, rejects private/reserved hosts at validation and again at delivery time, and restricts cURL to HTTP(S) only.

## Affected products

- Grav API Plugin before 1.0.6

## Timeline

- 2026-08-19: disclosed
- 2026-06-26: patched: Fix committed and released in 1.0.6

## References

- [https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e](https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e)
- [https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6](https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)