Security Advisory

CVE-2025-67427

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-01-05 00:00:00

Last updated 2026-01-05 21:26:10

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

← Browse all CVEs View on cve.org ↗