CVE-2025-67427

MEDIUM

6.5

Description

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

CVE Details

CVSS v3.1 Score6.5

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published1/5/2026

Last Modified1/12/2026

Sourcenvd

Honeypot Sightings0

Affected Products

evershop:evershop

Weaknesses (CWE)

CWE-918

References

https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67427(cve@mitre.org)

https://github.com/evershopcommerce/evershop(cve@mitre.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.