CVE-2026-62234: Getgrav Grav

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

Affected products

• Getgrav Grav: before 2.0.4 (fixed in 2.0.4)

Published 2026-07-17. Last modified 2026-07-23.