Vulnerability in Grav API Plugin for Grav CMS

CVE-2026-62668

What is CVE-2026-62668?

The Grav API Plugin, an essential component for Grav CMS offering RESTful access to site content, contains a vulnerability that allows unvalidated webhook URLs. Prior to version 1.0.6, the WebhookController.php only performed minimal syntax validation on the URLs, making it susceptible to file inclusion attacks, enabling malicious actors to access local files and execute unauthorized requests to internal services or cloud metadata endpoints. This flaw is addressed in the updated version 1.0.6, which restricts cURL options to mitigate such security risks.

References