Description
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.
Published: 2026-07-17
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Grav before version 2.0.4 does not restrict cURL protocol usage in webhook dispatch. An authenticated user with api.webhooks.write permissions can create webhook URLs that use file://, dict://, or gopher:// schemes. This flaw is an SSRF (CWE‑918) that permits an attacker to read local files, enumerate process information, or reach internal services by triggering the webhook.

Affected Systems

Any Grav installation built from the getgrav:grav product with a version earlier than 2.0.4 is affected. The bug resides in the webhook dispatch subsystem and is resolved in releases 2.0.4 and later.

Risk and Exploitability

The CVSS score of 8.4 denotes high severity, but the EPSS score is below 1 %, indicating a low probability of exploitation at present, and the vulnerability is not in CISA’s KEV. Exploitation requires the attacker to have an authenticated API user with write access to webhooks, after which they can craft a malicious webhook URL and trigger it to cause the server to request the target URL using an unsupported protocol.

Generated by OpenCVE AI on July 31, 2026 at 00:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Grav to version 2.0.4 or newer.
  • Restrict or remove the api.webhooks.write permission for users who do not need to create webhooks.
  • Enforce an outbound request whitelist that blocks file://, dict://, and gopher:// protocols for webhook calls.

Generated by OpenCVE AI on July 31, 2026 at 00:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
Description Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.
Title Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
First Time appeared Getgrav
Getgrav grav
Weaknesses CWE-918
CPEs cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
Vendors & Products Getgrav
Getgrav grav
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Getgrav Grav
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-23T19:27:48.492Z

Reserved: 2026-07-13T16:41:09.007Z

Link: CVE-2026-62234

cve-icon Vulnrichment

Updated: 2026-07-23T19:27:18.788Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T01:00:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)