high8.1
CVE-2026-62234
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with…
Impact
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.
Affected products
| Product | Affected versions |
|---|---|
| Grav | before 2.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.