PT-2025-34801 · Firecrawl · Firecrawl

Amplitudesxd · Publicado 2025-08-26 · Atualizado 2025-08-26 · CVE-2025-57818

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Firecrawl versions prior to 2.0.1

Description: Firecrawl is a tool that converts websites into LLM-ready markdown or structured data. A server-side request forgery (SSRF) vulnerability exists in the webhook functionality of Firecrawl. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, potentially allowing access to internal systems.

Recommendations: Upgrade to version 2.0.1 or later. If upgrading is not possible, isolate Firecrawl from any sensitive internal systems.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2025-57818

GHSA-P2WG-PRHF-JX79

Produtos afetados

Firecrawl

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57818.json · Exploit
• https://github.com/firecrawl/firecrawl/security/advisories/GHSA-p2wg-prhf-jx79 · Nota
• https://github.com/firecrawl/firecrawl/releases/tag/v2.0.1 · Nota
• https://github.com/firecrawl/firecrawl/commit/b15fae51a760e9810a66bbfde5d5693d0df3fbeb · Nota
• https://github.com/firecrawl/firecrawl/commit/e8cf0985b07968061a6b684b58097732e827ed46 · Nota
• https://t.me/cveNotify/133546 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-57818 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1960419863454687320 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-57818 · Nota de Segurança
• https://twitter.com/CVEnew/status/1960407129526825207 · Publicação no Twitter
• https://t.me/CVEtracker/30955 · Publicação no Telegram