CVE-2026-62668 in API Plugin
Summary
by MITRE • 08/19/2026
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Grav API Plugin serves as a RESTful interface for the Grav CMS platform, enabling headless access to site content through standard HTTP methods. A critical security vulnerability was identified within versions prior to 1.0.6, specifically affecting the WebhookController.php and WebhookDispatcher.php components. The core technical flaw stems from insufficient input validation when processing webhook URLs submitted by users with api.webhooks.write permissions. While the system employs FILTER_VALIDATE_URL for basic syntax checking, this mechanism is inadequate as it only verifies structural correctness of a Uniform Resource Identifier without enforcing protocol restrictions or validating against dangerous schemes. Consequently, attackers can inject maliciously crafted URLs that utilize protocols such as file, dict, gopher, private-network, and link-local addresses.
The severity of this vulnerability is exacerbated by the implementation details within WebhookDispatcher.php, which initializes cURL requests to deliver webhook payloads. The library was configured without setting CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS options. These curl options are essential for restricting the protocols that can be used during a request and its subsequent redirects. Without these restrictions, the application allows unrestricted protocol usage, enabling an authenticated attacker to leverage the server's network capabilities to perform Server-Side Request Forgery attacks. This configuration oversight transforms what might appear as a simple webhook submission feature into a powerful vector for internal network reconnaissance and data exfiltration.
The operational impact of this vulnerability is significant due to its potential for lateral movement and sensitive data retrieval. An attacker with the appropriate API permissions can submit requests targeting local file systems, effectively reading arbitrary files from the server where Grav CMS is hosted. This capability allows for the extraction of configuration files containing database credentials, application secrets, or other sensitive administrative data. Furthermore, by utilizing protocols like gopher or dict, an attacker can pivot requests to internal services that are not exposed to the public internet but are accessible within the local network environment. This includes querying internal databases, interacting with legacy systems, or accessing cloud metadata endpoints such as those found in AWS EC2 instances or Google Cloud Platform environments. Such actions facilitate unauthorized access to infrastructure resources and compromise the integrity of the entire deployment architecture.
This vulnerability aligns with CWE-918, which addresses Server-Side Request Forgery (SSRF), specifically highlighting flaws related to insufficient validation of user-supplied URLs that lead to unintended network interactions. It also maps to MITRE ATT&CK technique T1504, Web Service Discovery, as the attacker uses the compromised webhook functionality to probe and interact with internal services. Additionally, the ability to read local files corresponds to CWE-284, Improper Access Control, while the exploitation of cloud metadata endpoints relates to techniques used in credential harvesting attacks against containerized or virtualized environments. The lack of protocol restrictions represents a failure in implementing proper security controls for outbound network connections initiated by server-side processes.
To mitigate this vulnerability, organizations must immediately upgrade the Grav API Plugin to version 1.0.6 or later, where these issues have been addressed through stricter input validation and secure cURL configuration. For systems that cannot be updated immediately, administrators should implement a reverse proxy or web application firewall rules that inspect outbound webhook requests for dangerous protocols such as file://, gopher://, dict://, and link-local addresses. Additionally, restricting the api.webhooks.write permission to only trusted internal services can reduce the attack surface. It is also recommended to configure cURL with CURLOPT_PROTOCOLS set to allow only http and https schemes, thereby preventing the execution of arbitrary protocols that could be exploited for SSRF attacks. Regular auditing of API permissions and continuous monitoring of outbound network traffic from application servers are essential practices to detect and prevent such exploitation attempts in production environments.