CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-24354: imgproxy is vulnerable to SSRF against 0.0.0.0
5.3
CVSS
Description
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.
Classification
CVE ID: CVE-2025-24354
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
Affected Products
Vendor: imgproxy
Product: imgproxy
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.72% (scored less or equal to compared to others)
EPSS Date: 2025-02-25 (when was this score calculated)
References
https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081