PT-2026-1329 · Evershop · Evershop

Published 2026-01-05 · Updated 2026-01-06 · CVE-2025-67427

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions evershop versions prior to 2.1.1

Description A Blind Server-Side Request Forgery (SSRF) exists in evershop versions prior to 2.1.1. An unauthenticated attacker can force the server to initiate an HTTP request via the ''/images'' API endpoint. This is due to insufficient validation of the src query parameter, allowing arbitrary HTTP or HTTPS URIs to be used, potentially leading to requests against internal and external networks.

Recommendations Update evershop to version 2.1.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-67427

GHSA-VP8W-WJ4M-3R7J

Affected Products

Evershop

References · 9

• 🔥 https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67427 · Exploit
• https://osv.dev/vulnerability/CVE-2025-67427 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vp8w-wj4m-3r7j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67427 · Security Note
• https://github.com/evershopcommerce/evershop · Note
• https://pages.dos-m0nk3y.com/blog/EverShop%202.1.0%20-%20Unauthenticated%20DoS/#server-side-request-forgery-ssrf-cve-2025-67427 · Note
• https://twitter.com/VulmonFeeds/status/2008440792474333245 · Twitter Post
• https://t.me/CVEtracker/41422 · Telegram Post
• https://twitter.com/CVEnew/status/2008265039699226997 · Twitter Post