CVE-2026-62234: Grav CMS Information Disclosure Flaw

CVE-2026-62234 Overview

CVE-2026-62234 is a Server-Side Request Forgery (SSRF) vulnerability in the Grav content management system before version 2.0.4. The flaw resides in the webhook dispatch functionality, which fails to restrict cURL protocol handlers. Authenticated users holding the api.webhooks.write permission can register webhooks using file://, dict://, or gopher:// URLs. Triggering the webhook then causes the server to read local files, expose process information, or pivot to internal services. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery).

Critical Impact
Authenticated attackers can exfiltrate local files and reach internal network services through unrestricted cURL protocol handlers in Grav webhooks.

Affected Products

Grav CMS versions prior to 2.0.4
Grav installations exposing the webhooks API to non-administrative roles
Deployments where the api.webhooks.write permission is granted to untrusted users

Discovery Timeline

2026-07-17 - CVE-2026-62234 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-62234

Vulnerability Analysis

Grav's webhook subsystem uses cURL to dispatch HTTP callbacks when configured events fire. The dispatcher does not constrain the CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS options. Consequently, any protocol compiled into the local libcurl build becomes reachable through the webhook target URL. An authenticated user with the api.webhooks.write permission can register a webhook whose target is file:///etc/passwd, file:///proc/self/environ, or a gopher:// URL that speaks arbitrary TCP payloads to an internal service. When the webhook event fires, the Grav server performs the request in its own security context and returns or logs response data that the attacker can retrieve.

Root Cause

The root cause is missing protocol allowlisting during cURL handle initialization inside the webhook dispatcher. Without an explicit allowlist restricting requests to http and https, libcurl honors any scheme it supports. The design also treats the api.webhooks.write permission as a low-trust capability, even though webhook URLs are effectively server-side fetch primitives.

Attack Vector

Exploitation requires an authenticated account with api.webhooks.write. The attacker creates a webhook definition pointing to file:/// for local file disclosure, dict://internal-host:port/ for banner grabbing on internal services, or gopher://internal-host:port/_<payload> to interact with unauthenticated backends such as Redis or memcached. Triggering the associated event dispatches the request from the Grav server, breaching the trust boundary between the public application and internal infrastructure. Full technical detail is available in the GitHub Security Advisory and the VulnCheck Advisory on SSRF.

Detection Methods for CVE-2026-62234

Indicators of Compromise

Webhook records in Grav configuration containing URLs with file://, dict://, gopher://, ldap://, or ftp:// schemes
Outbound connections from the Grav application server to loopback or RFC1918 addresses that were not previously observed
Grav application logs showing webhook dispatch errors referencing non-HTTP schemes or local file paths

Detection Strategies

Audit the Grav database and configuration files for stored webhook definitions and flag any target URL whose scheme is not http or https
Inspect web access logs for POST requests to webhook management endpoints followed by anomalous outbound traffic from the server
Correlate authenticated API activity from users with api.webhooks.write against the timing of unusual local file access on the host

Monitoring Recommendations

Alert on any egress from the Grav host to internal management interfaces, metadata services (169.254.169.254), or unexpected TCP ports
Monitor Grav user role assignments and generate alerts when api.webhooks.write is granted to accounts outside the administrator group
Enable verbose logging of webhook dispatch operations and forward the logs to a centralized SIEM for retention and correlation

How to Mitigate CVE-2026-62234

Immediate Actions Required

Upgrade Grav to version 2.0.4 or later, which enforces protocol restrictions in the webhook dispatcher
Review all existing webhook definitions and delete any that use non-HTTP schemes
Revoke the api.webhooks.write permission from accounts that do not require it and rotate credentials for accounts that had this permission

Patch Information

The fix is included in Grav 2.0.4. The upstream patch restricts cURL protocols to http and https for both initial requests and redirects. Refer to the GitHub Security Advisory GHSA-58q8-f7v4-w2vf for the specific commits and release notes.

Workarounds

Place the Grav server behind an egress proxy that restricts outbound traffic to explicitly allowed HTTP and HTTPS destinations
Deny the Grav process network access to loopback, link-local, and RFC1918 address space using host-based firewall rules
Temporarily disable the webhooks feature or restrict the api.webhooks.write permission to a single administrator account until the patch is applied

bash

# Example iptables egress restriction for the Grav service account (uid 33 = www-data)
iptables -A OUTPUT -m owner --uid-owner 33 -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 33 -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 33 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 33 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 33 -d 192.168.0.0/16 -j REJECT