Home

Description

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2.

PUBLISHED Reserved 2024-11-14 | Published 2025-05-29 | Updated 2025-05-29 | Assigner GitHub_M




MEDIUM: 4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

Product status

< 4.25.2
affected

References

github.com/...strapi/security/advisories/GHSA-v8wj-f5c7-pvxf

cve.org (CVE-2024-52588)

nvd.nist.gov (CVE-2024-52588)

Download JSON