PT-2025-35514 · Langfuse · Langfuse

Zast.Ai · Published 2025-09-01 · Updated 2025-12-02 · CVE-2025-9799

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Langfuse versions through 3.88.0

Description A security flaw exists in Langfuse, potentially leading to server-side request forgery. The vulnerability is located in the promptChangeEventSourcing function within the web/src/features/prompts/server/routers/promptRouter.ts file of the Webhook Handler component. The attack can be initiated remotely and requires a high degree of complexity, though exploitation appears to be difficult. The exploit has been released publicly.

Recommendations Versions prior to 3.88.0 are recommended.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-9799

Affected Products

Langfuse

References · 12

• 🔥 https://github.com/langfuse/langfuse/issues/8522#issue-3320549867 · Exploit
• 🔥 https://github.com/langfuse/langfuse/issues/8522 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9799 · Security Note
• https://t.me/CVEtracker/31461 · Telegram Post
• https://twitter.com/CVEnew/status/1962640214909702532 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1962647510641516771 · Twitter Post
• https://vuldb.com/?id.322114 · Note
• https://vuldb.com/?ctiid.322114 · Note
• https://t.me/cveNotify/134048 · Telegram Post
• https://t.me/cveNotify/144554 · Telegram Post
• https://vuldb.com/?submit.641128 · Note