Grav before version 2.0.4 does not properly restrict the protocols allowed in webhook dispatch URLs. Authenticated users with the api.webhooks.write permission can create webhooks that use potentially dangerous protocols like file://, dict://, or gopher://. When these webhook events are triggered, they can be exploited to perform Server-Side Request Forgery (SSRF) attacks, enabling attackers to read local files, gather process information, or access internal network services through unrestricted protocol handlers. This vulnerability is identified as CVE-2026-62234 with a CVSS 4.0 score of 8.4, indicating a high severity risk. No official patch or remediation level is explicitly stated in the provided data, but the affected versions are clearly identified as those before 2.0.4.

Successful exploitation allows an authenticated user with limited permissions to perform SSRF attacks via webhook events. This can lead to unauthorized reading of local files, exposure of process information, and potential pivoting to internal services, which compromises confidentiality and internal network security. The vulnerability does not require user interaction and has a low attack complexity, increasing the risk of exploitation within affected environments.

Upgrade Grav to version 2.0.4 or later, where this vulnerability is addressed by restricting allowed protocols in webhook dispatch URLs. Since the affected versions are explicitly before 2.0.4, applying this update is the recommended remediation. No vendor advisory or official patch link is provided in the data, so verify the availability of the fix from the vendor's official sources before applying. Until patched, restrict api.webhooks.write permissions to trusted users only to reduce risk.