PT-2025-41177 · Vllm · Vllm

Published 2025-10-07 · Updated 2025-10-09 · CVE-2025-6242

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions vLLM (affected versions not specified)

Description An issue exists within the MediaConnector class in the vLLM project’s multimodal feature set. Specifically, the load from url and load from url async methods do not sufficiently restrict the target hosts when fetching and processing media from URLs provided by users. This can allow an attacker to force the vLLM server to make requests to arbitrary internal network resources, resulting in a Server-Side Request Forgery (SSRF).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Open Redirect

Weakness Enumeration

CWE-918

CWE-601

Related Identifiers

CVE-2025-6242

GHSA-3F6C-7FW2-PPM4

Affected Products

Vllm

References · 14

• https://osv.dev/vulnerability/GHSA-3f6c-7fw2-ppm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6242 · Security Note
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/security/advisories/GHSA-3f6c-7fw2-ppm4 · Note
• https://github.com/vllm-project/vllm/commit/9d9a2b77f19f68262d5e469c4e82c0f6365ad72d · Note
• https://t.me/CVEtracker/34370 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2373716 · Note
• https://twitter.com/CVEnew/status/1975656488170344630 · Twitter Post
• https://twitter.com/CheckmarxZero/status/1976362163200536871 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1975811189675331605 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-6242 · Note
• https://reddit.com/r/VulnMatter/comments/1o1aw7v/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post