CVE-2025-4515: Zylon PrivateGPT settings.yaml cross-domain policy
First published: Sat May 10 2025(Updated: )
A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zylon PrivateGPT | <=0.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4515?
CVE-2025-4515 is classified as problematic due to its impact on cross-domain policy.
How do I fix CVE-2025-4515?
To fix CVE-2025-4515, ensure that the 'allow_origins' argument in settings.yaml is configured to restrict access only to trusted domains.
What is affected by CVE-2025-4515?
CVE-2025-4515 affects Zylon PrivateGPT versions up to and including 0.6.2.
What type of vulnerability is CVE-2025-4515?
CVE-2025-4515 is a cross-domain policy vulnerability that allows permissive access to untrusted domains.
Can CVE-2025-4515 lead to exploitation?
Yes, CVE-2025-4515 can potentially lead to exploitation by allowing unauthorized requests from untrusted sources.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/zylon
- canonical/zylon privategpt