PT-2025-30343 · Manager Io · Imanager

Kr1Shna4Garwal · CVE-2025-54122 · Published 2025-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Manager-io/Manager versions prior to 25.7.21.2525

Description An unauthenticated full read Server-Side Request Forgery (SSRF) issue exists in the proxy handler component. This allows an attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and the exfiltration of sensitive data from isolated network segments via the 'proxy' endpoint.

Recommendations Update to version 25.7.21.2525.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-54122

GHSA-347W-CGWH-M895

Affected Products

Imanager

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54122.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54122 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54122 · Vendor Advisory
• https://github.com/Manager-io/Manager/security/advisories/GHSA-347w-cgwh-m895 · Note
• https://twitter.com/the_yellow_fall/status/1947836572889710726 · Twitter Post
• https://t.me/cvetracker/28332 · Telegram Post
• https://twitter.com/CVEnew/status/1947405331354816665 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1947481687383761268 · Twitter Post
• https://t.me/pentestingnews/64973 · Telegram Post
• https://twitter.com/zoomeye_team/status/2079455535150305559 · Twitter Post