External risk intelligence

Grav API Plugin Webhook Vulnerability Allows Restricted Protocol Access

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-62668

The vulnerability affects a RESTful API plugin for a web CMS. Since this component is designed to provide external, headless access to site content, it is commonly deployed as an internet-facing service or API endpoint, increasing the likelihood of exposure.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Grav API Plugin has a critical vulnerability that could allow an attacker with write access to webhooks to retrieve local files or interact with internal services. This issue affects the Grav CMS's RESTful API plugin, which provides headless content access.

API plugin allows unauthorized file access.
This issue impacts headless content access systems.
Confirm if your content API is exposed to risk.

Attack Path

How an attacker could exploit the issue

An attacker with write access to API webhooks can leverage this vulnerability by submitting specially crafted webhook URLs. The plugin, lacking sufficient protocol restrictions, allows these URLs to target file protocols or internal network addresses. This can result in the retrieval of sensitive local files or the redirection of requests to internal services, potentially exposing further system details or enabling pivoting attacks.

Requires authenticated user with webhook write access.
Submits a malicious webhook URL.
Risk of local file retrieval and internal pivoting.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user with webhook write permissions could leverage this vulnerability to access local files or pivot requests to internal services and cloud metadata endpoints.

Local files and internal service data at risk.
Requests can be sent to sensitive endpoints.
Internal network reconnaissance and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Grav API plugin's webhook functionality is susceptible to exploitation by authenticated users with `api.webhooks.write` permissions. This could allow for the retrieval of local files and pivoting to internal services or cloud metadata endpoints. Owners of applications utilizing the Grav API plugin should first identify all instances of the plugin, assess their reachability and business criticality, and then determine the appropriate remediation plan based on risk.

Application owners should own the issue.
Verify plugin instances and their reachability.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grav API Plugin?

The Grav API Plugin is a component for Grav CMS that enables a headless architecture. It provides a RESTful interface, allowing developers to manage and retrieve site content programmatically without using the standard web interface. This makes it useful for building decoupled frontends or integrating Grav content into external applications.

What is the weakness in CVE-2026-62668?

This vulnerability is classified as Server-Side Request Forgery (CWE-918). It occurs because the plugin fails to properly restrict the protocols used by its webhook dispatcher. Because the system does not validate that a URL is limited to standard web traffic, it can be coerced into using unconventional protocols like 'file' or 'gopher' to access unintended local resources or internal network targets.

How can an attacker trigger this vulnerability?

An attacker needs an account with 'api.webhooks.write' permissions to submit a crafted webhook URL. The bug is triggered when the plugin processes this URL through its unconstrained cURL initialization. Normal, legitimate webhook usage that targets standard external web services does not trigger the flaw; only inputs designed to exploit the lack of protocol filtering create the risk.

How does Halo Surface Signal assess this risk?

Halo Surface Signal flags this as a likely concern because the Grav API Plugin is inherently designed to provide external, headless access to site content. This design intent means the plugin is frequently deployed in internet-facing configurations, which broadens the potential attack surface compared to internal-only components.

Do I need to update my Grav API Plugin?

Yes. If you use this plugin, you should move to version 1.0.6 or later to resolve the issue. Your first step is to audit your environment to identify all active instances of the Grav API Plugin. After locating these, prioritize patching them, especially those that are accessible over the internet, to prevent unauthorized access to local files or internal system services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.