PT-2025-26492 · Fastgpt · Fastgpt

C121914Yu · Published 2025-06-21 · Updated 2025-12-29 · CVE-2025-52552

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FastGPT versions prior to 4.9.12

Description: The issue concerns the LastRoute Parameter on the login page, which is vulnerable to open redirect and DOM-based XSS due to improper validation and lack of sanitization. This allows attackers to execute malicious JavaScript or redirect users to attacker-controlled sites.

Recommendations: For versions prior to 4.9.12, update to version 4.9.12 to resolve the issue. As a temporary workaround, consider restricting access to the LastRoute Parameter on the login page to minimize the risk of exploitation. Avoid using the LastRoute parameter in the affected login page until the issue is resolved.

Exploit

Fix

Open Redirect

XSS

Weakness Enumeration

CWE-601

CWE-79

Related Identifiers

CVE-2025-52552

GHSA-R976-RFRV-Q24M

Affected Products

Fastgpt

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52552.json · Exploit
• https://github.com/labring/FastGPT/security/advisories/GHSA-r976-rfrv-q24m · Vendor Advisory
• https://github.com/labring/FastGPT/commit/095b75ee27746004106eddeaa4840688a61ff6eb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-52552 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52552 · Vendor Advisory
• https://t.me/cvetracker/26734 · Telegram Post
• https://t.me/cveNotify/147062 · Telegram Post
• https://twitter.com/CVEnew/status/1936472502802198559 · Twitter Post