CVE-2026-62234CWE-918ssrf

CVE-2026-62234

High · published July 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-17T06:18Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf · [email protected]https://www.vulncheck.com/advisories/grav-ssrf-via-unrestricted-curl-protocols · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUL 00:07Z
    Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
    cvelistv5