CVE-2025-10471: ZKEACMS MediaController.cs Proxy server-side request forgery

Published Sep 15, 2025

Updated

A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of the argument url results in server-side request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Affected Software

2 affected components

ZKEACMS ZKEACMS

ZKEA ZKEACMS=4.3

Event History

Sep 15, 2025

CVE Published

via MITRE·04:32 PM

Data Sourced

via MITRE·04:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10471?

CVE-2025-10471 is classified as a critical vulnerability due to its ability to enable server-side request forgery attacks.

How do I fix CVE-2025-10471?

To fix CVE-2025-10471, ensure that the application is updated to the latest version provided by ZKEACMS, which includes the necessary patches.

What are the potential impacts of CVE-2025-10471?

The potential impacts of CVE-2025-10471 include unauthorized access to sensitive information and the ability to make requests to internal services.

Who is affected by CVE-2025-10471?

CVE-2025-10471 affects users of ZKEACMS version 4.3, particularly those using the MediaController functionality.

How can CVE-2025-10471 be exploited?

CVE-2025-10471 can be exploited by manipulating the 'url' argument in the Proxy function of the MediaController, allowing an attacker to send crafted requests.