PT-2025-38254 · Dragonfly · Dragonfly

Gaius-Qi · Published 2025-09-17 · Updated 2025-10-27 · CVE-2025-59346

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0

Description Dragonfly is a P2P-based file distribution and image acceleration system susceptible to a server-side request forgery (SSRF) vulnerability. This flaw allows users to force Dragonfly2’s components to make requests to internal services that are otherwise inaccessible. The issue stems from weak validation of user-supplied URLs when creating Preheat jobs via the Manager API, the pieceManager.DownloadSource method in peer-to-peer communication, and HTTP clients following redirects. This can lead to probing or access of internal HTTP endpoints.

Recommendations Upgrade to version 2.1.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-59346

GHSA-G2RQ-JV54-WCPR

GO-2025-3968

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Dragonfly

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59346.json · Exploit
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-g2rq-jv54-wcpr · Patch
• https://osv.dev/vulnerability/GHSA-g2rq-jv54-wcpr · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59346 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59346 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3968 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://github.com/dragonflyoss/dragonfly · Note
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf · Note
• https://suse.com/security/cve/CVE-2025-59350 · Note
• https://twitter.com/CVEnew/status/1968561218848723112 · Twitter Post
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2025-23266 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note