CVE-2026-62234
HIGH
CVSS 8.4
grav
Verified Advisory
Server-Side Request Forgery in Grav CMS (CVE-2026-62234)
Grav before version 2.0.4 fails to restrict cURL protocols when dispatching webhooks, allowing authenticated users with the api.webhooks.write permission to create webhooks using file://, dict://, or gopher:// scheme URLs. At dispatch time, curl_init() is invoked without CURLOPT_PROTOCOLS restrictions, enabling local file reads and internal service pivoting (SSRF).
Affected versions:
- 2.0.3
We recommend updating to: 2.0.4.
CVSS 8.4 · our assessment: this_week
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf
Details: https://vuln.today/cve/CVE-2026-62234
Verified by vuln.today against published advisories.
Affected versions
- – 2.0.3
Fixed in: 2.0.4
More advisories for grav
- CVE-2026-65608 – Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
- CVE-2026-65895 – Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
- CVE-2026-65896 – Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
- CVE-2026-65897 – Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
- CVE-2026-65603 – Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
- CVE-2026-65008 – Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
- CVE-2026-65007 – Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)