CVE-2025-67427 | THREATINT

Description

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

PUBLISHED Reserved 2025-12-08 | Published 2026-01-05 | Updated 2026-01-05 | Assigner mitre

References

github.com/evershopcommerce/evershop

github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67427

cve.org (CVE-2025-67427)

nvd.nist.gov (CVE-2025-67427)

Download JSON