Grav API Plugin CVE-2026-62668

Exploitation requires an authenticated Grav API key whose scope includes api.webhooks.write (per CVSS PR:L); an unscoped/unprivileged key or session cannot register webhooks. Beyond that, no non-default configuration is needed - the vulnerable FILTER_VALIDATE_URL-only validation and unrestricted cURL protocols are the default behavior in grav-plugin-api versions before 1.0.6. The attack is limited to what the server can reach on the network: file disclosure requires readable local paths, and metadata/internal-pivot impact requires that the Grav host actually has network access to 169.254.169.254 or internal services (a host with strict egress filtering and IMDSv2 substantially limits the payoff). No user interaction is required.

The vendor CVSS 4.0 score of 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is aggressive: it treats the SSRF as yielding full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, which is plausible for gopher-based writes to internal services and metadata-credential theft but is an upper-bound reading - the described primary impact (retrieving local files and response bodies, pivoting requests) is most reliably a confidentiality/pivot issue, with integrity/availability contingent on what internal services are reachable. The one genuine gating factor is PR:L: the attacker must already possess an API key carrying the api.webhooks.write scope, so this is not an unauthenticated internet-wide bug, and no EPSS score, KEV listing, or public PoC was provided to indicate active or automated exploitation. That said, the low attack complexity and the high value of the targets (cloud metadata credentials, internal-service pivot) mean any operator who issues scoped API keys to semi-trusted integrators or tenants should treat this as urgent and patch promptly rather than deferring on the assumption that the required privilege makes it low-risk. The realistic risk is high for multi-tenant or integration-heavy Grav deployments and lower for single-operator sites where the only key holders are fully trusted administrators.

An attacker holding a Grav API key scoped for api.webhooks.write registers a webhook pointing at http://169.254.169.254/latest/meta-data/iam/security-credentials/ (or a file:// path). When the dispatcher fires, the Grav server fetches the target and returns the response body - including temporary cloud IAM credentials or local file contents - back to the attacker. No public PoC is identified at time of analysis, but the low attack complexity means exploitation requires only a valid crafted webhook registration request.