Server-Side Request Forgery in Grav CMS (CVE-2026-62234)

Grav before version 2.0.4 fails to restrict cURL protocols when dispatching webhooks, allowing authenticated users with the api.webhooks.write permission to create webhooks using file://, dict://, or gopher:// scheme URLs. At dispatch time, curl_init() is invoked without CURLOPT_PROTOCOLS restrictions, enabling local file reads and internal service pivoting (SSRF). Affected versions: - 2.0.3 We recommend updating to: 2.0.4. CVSS 8.4 · our assessment: this_week Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf Details: https://vuln.today/cve/CVE-2026-62234