medium5.3
CVE-2026-56708
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by D…
Impact
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.
Affected products
| Product | Affected versions |
|---|---|
| Grav API Plugin | before 1.0.16 |
Versions were read from the advisory text. No structured product data has been published for this record yet.