PT-2025-46842 · Lichess · Lila

Published 2025-11-13 · Updated 2026-01-09 · CVE-2025-52186

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Lichess lila versions prior to commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02)

Description The software contains a Server-Side Request Forgery (SSRF) issue in the game export API. The players parameter is passed to an internal HTTP client without proper validation, potentially allowing attackers to make the server send HTTP requests to arbitrary URLs.

Recommendations Update Lichess lila to version commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-52186

Affected Products

Lila

References · 5

• 🔥 https://hackerone.com/reports/3165242 · Exploit
• https://osv.dev/vulnerability/CVE-2025-52186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52186 · Security Note
• https://github.com/lichess-org/lila/commit/11b4c0fb00f0ffd8232346f839627005459c8f05c · Note
• https://t.me/cveNotify/148225 · Telegram Post