PT-2025-45352 · Unknown · Metinfo Cms

Published 2025-11-06 · Updated 2026-02-04 · CVE-2025-63551

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MetInfo Content Management System (CMS) versions through 8.1

Description A Server-Side Request Forgery (SSRF) issue, achievable through an XML External Entity (XXE) injection, exists. The flaw is due to a defect in the XML parsing logic, allowing an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the API endpoint /admin/#/webset/?head tab active=0, where user-provided XML data is processed.

Recommendations Versions prior to 8.1 should be updated. As a temporary workaround, consider restricting access to the API endpoint /admin/#/webset/?head tab active=0 until a fix is available.

Exploit

Fix

SSRF

XXE

Weakness Enumeration

CWE-918

CWE-611

Related Identifiers

CVE-2025-63551

Affected Products

Metinfo Cms

References · 6

• 🔥 https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection/blob/main/README.md · Exploit
• 🔥 https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection · Exploit
• https://osv.dev/vulnerability/CVE-2025-63551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63551 · Security Note
• https://t.me/cveNotify/150916 · Telegram Post
• https://t.me/CVEtracker/36704 · Telegram Post