PT-2025-41454 · New Api · New Api

Mada2Aa

+1

·

Published

2025-10-09

·

Updated

2026-05-18

·

CVE-2025-59146

CVSS v3.1

8.5

High

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions New API versions prior to 0.9.0.5
Description New API is a large language model (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side Request Forgery (SSRF) issue exists because the application does not properly validate user-supplied URLs before making server-side requests. This allows authenticated users to submit a URL to a vulnerable endpoint, potentially coercing the server to send requests to arbitrary internal or external services. Server-Side Request Forgery (SSRF) occurs when an application makes requests to an unintended location. The vulnerability is not limited to image URLs and can be triggered with any link provided to the vulnerable endpoint.
Recommendations Update to version 0.9.0.5 or later to benefit from the new user-configurable SSRF protection module. As a temporary workaround, enable the new-api image processing worker (new-api-worker). As a temporary workaround, configure egress firewall rules.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-59146
GHSA-XXV6-M6FX-VFHH

Affected Products

New Api