PT-2026-60644

CVE-2026-62234

Published

2026-07-17

Updated

2026-07-23

Description by

CVSS 4.0

8.4

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4

Description Authenticated users with api.webhooks.write permission can create webhooks using unrestricted cURL protocols such as file://, dict://, or gopher://. This allows attackers to trigger webhook events to read local files, access process information, or pivot to internal services.

Recommendations Update to version 2.0.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Gemstone-Source

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers