Security Advisory
CVE-2026-62234
8.1
HIGH
Vulnerability Description
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.
Published Date
July 17, 2026
Official Source
NIST NVD Advisory