PT-2025-34801 · Firecrawl · Firecrawl

Amplitudesxd · Published 2025-08-26 · Updated 2025-08-26 · CVE-2025-57818

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Firecrawl versions prior to 2.0.1

Description: Firecrawl is a tool that converts websites into LLM-ready markdown or structured data. A server-side request forgery (SSRF) vulnerability exists in the webhook functionality of Firecrawl. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, potentially allowing access to internal systems.

Recommendations: Upgrade to version 2.0.1 or later. If upgrading is not possible, isolate Firecrawl from any sensitive internal systems.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-57818

GHSA-P2WG-PRHF-JX79

Affected Products

Firecrawl

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57818.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-57818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57818 · Security Note
• https://github.com/firecrawl/firecrawl/security/advisories/GHSA-p2wg-prhf-jx79 · Note
• https://github.com/firecrawl/firecrawl/releases/tag/v2.0.1 · Note
• https://github.com/firecrawl/firecrawl/commit/b15fae51a760e9810a66bbfde5d5693d0df3fbeb · Note
• https://github.com/firecrawl/firecrawl/commit/e8cf0985b07968061a6b684b58097732e827ed46 · Note
• https://t.me/cveNotify/133546 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1960419863454687320 · Twitter Post
• https://twitter.com/CVEnew/status/1960407129526825207 · Twitter Post
• https://t.me/CVEtracker/30955 · Telegram Post