CVE-2026-62668 is an SSRF in Grav CMS's API plugin affecting versions prior to 1.0.6. The vulnerability chains two well-documented weaknesses: PHP's FILTER_VALIDATE_URL performs syntactic validation only (it doesn't block dangerous protocols), and cURL's default behavior follows redirects and supports multiple protocols including file://, gopher://, and dict://. Combined, an attacker with api.webhooks.write permission can read local files, pivot to cloud metadata endpoints (169.254.169.254), and tunnel requests to internal services like Redis for secondary exploitation.
The CVSS 9.4 is technically accurate for damage potential, but the api.webhooks.write permission requirement changes the practical threat model. These tokens aren't rare administrative credentials — they're routinely issued to developers for CI/CD pipelines, headless frontend integrations, and third-party webhooks. That means the credential class required to exploit this is exactly the type that ends up in environment variables, CI configurations, and service accounts with broad exposure. The permission gate isn't meaningless, but it's not a strong barrier either; it's a gate that legitimate workflows pass through routinely.
The EPSS score of 0.0033 reflects the niche nature of this plugin, not necessarily effective defense. More importantly, Grav plugins don't follow the auto-update cadences of major CMS platforms — many deployments pin versions for stability, meaning the real exposure window could be months rather than days.
Priority actions: audit all api.webhooks.write tokens in your environment, restrict them to specific source IPs if possible, and verify whether 1.0.6 implements protocol allowlisting (cURL --proto flag) rather than a denylist, which is trivially bypassed. The historical pattern of FILTER_VALIDATE_URL + unrestricted cURL recurring across ecosystems (Salesforce, Mattermost, GitLab) suggests this fix alone may not be the last SSRF in this codebase.