CVE-2025-67427 | BDVDB-2026-309121 Detail

Description#

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-01-05Record published in the CVE List.