What is CVE-2026-62668?
This vulnerability is found in the Grav API Plugin for Grav CMS. It accepts webhook URLs with only syntax validation using FILTER_VALIDATE_URL, and initializes cURL without CURLOPT_PROTOCOLS restrictions, potentially allowing Server-Side Request Forgery (SSRF) attacks. Users running versions prior to 1.0.6 should update immediately.
Azərbaycanca: Bu zəiflik Grav CMS üçün RESTful API plaginində aşkarlanıb. Plagin vebhook URL-lərini yalnız sintaksisə görə yoxlayır (FILTER_VALIDATE_URL), lakin cURL-i protokol məhdudiyyəti olmadan işlədir, bu da potensial SSRF (Server-Side Request Forgery) hücumlarına yol aça bilər. Plaginin 1.0.6-dan əvvəlki versiyalarını işlədənlər təcili yeniləmə etməlidirlər.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
How can I protect against CVE-2026-62668?
To protect against this SSRF vulnerability, you must update the Grav API Plugin to at least version 1.0.6.
What is the root cause of CVE-2026-62668?
The root cause is that the plugin performs only syntax validation on webhook URLs using FILTER_VALIDATE_URL and initializes cURL without any protocol restrictions (CURLOPT_PROTOCOLS).
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.