CVE-2026-62234

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N                                    

Vulnerability Description

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

Vulnerability Details

Published Date

July 17, 2026

Last Modified

July 17, 2026

CWE ID

CWE-918

Source

NVD

Vendor

getgrav

Product

grav

External References

https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf
https://www.vulncheck.com/advisories/grav-ssrf-via-unrestricted-curl-protocols

CVE-2026-62234

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment