PT-2025-47975 · Unknown · Llm Gateway

Published 2025-11-24 · Updated 2026-05-18 · CVE-2025-62155

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions New API versions prior to 0.9.6

Description New API is a large language model (LLM) gateway and artificial intelligence (AI) asset management system. A Server-Side Request Forgery (SSRF) condition existed in versions prior to 0.9.6. A previous security fix was susceptible to bypass through the use of HTTP 302 redirects. The initial fix only applied security restrictions to the first URL request, allowing attackers to leverage redirects to access internal network resources. The issue involves bypassing existing security measures to access the intranet.

Recommendations Update to New API version 0.9.6.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-62155

GHSA-9F46-W24H-69W4

GO-2025-4154

SUSE-SU-2026:0037-1

Affected Products

Llm Gateway

References · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62155.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62155 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62155 · Security Note
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note
• https://twitter.com/VulmonFeeds/status/1993117720259280999 · Twitter Post
• https://suse.com/security/cve/CVE-2025-65796 · Note
• https://suse.com/security/cve/CVE-2024-41260 · Note
• https://suse.com/security/cve/CVE-2025-47913 · Note
• https://suse.com/security/cve/CVE-2025-54410 · Note
• https://suse.com/security/cve/CVE-2025-11777 · Note
• https://suse.com/security/cve/CVE-2025-34429 · Note
• https://suse.com/security/cve/CVE-2025-68944 · Note
• https://twitter.com/CVEnew/status/1993125716926591063 · Twitter Post