PT-2025-31048 · Ssrfcheck · Ssrfcheck

Liran Tal · Published 2025-07-28 · Updated 2026-05-05 · CVE-2025-8267

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ssrfcheck versions prior to 1.2.0

Description The package is vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. The package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid, allowing attackers to craft requests targeting these multicast addresses.

Recommendations Update to ssrfcheck version 1.2.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-8267

GHSA-C2FV-2FMJ-9XRX

GHSA-P4HC-9PJH-55C8

Affected Products

Ssrfcheck

References · 15

• 🔥 https://security.snyk.io/vuln/SNYK-JS-SSRFCHECK-9510756 · Exploit
• 🔥 https://gist.github.com/lirantal/2976840639df824cb3abe60d13c65e04 · Exploit
• https://github.com/felippe-regazio/ssrfcheck/commit/9507b49fd764f2a1a1d1e3b9ee577b7545e6950e · Patch
• https://osv.dev/vulnerability/CVE-2025-8267 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4hc-9pjh-55c8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2fv-2fmj-9xrx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8267 · Security Note
• https://github.com/felippe-regazio/ssrfcheck/security/advisories/GHSA-p4hc-9pjh-55c8 · Note
• https://github.com/felippe-regazio/ssrfcheck · Note
• https://github.com/felippe-regazio/ssrfcheck/issues/5 · Note
• https://twitter.com/CVEnew/status/1949708150287794288 · Twitter Post
• https://twitter.com/CveFindCom/status/1949699168621961346 · Twitter Post
• https://twitter.com/liran_tal/status/1957217133554716909 · Twitter Post
• https://t.me/CVEtracker/28539 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1949708829349892578 · Twitter Post