CVE-2025-4515: Zylon PrivateGPT settings.yaml cross-domain policy
A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument alloworigins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4515?
CVE-2025-4515 is classified as problematic due to its impact on cross-domain policy.
How do I fix CVE-2025-4515?
To fix CVE-2025-4515, ensure that the 'allow_origins' argument in settings.yaml is configured to restrict access only to trusted domains.
What is affected by CVE-2025-4515?
CVE-2025-4515 affects Zylon PrivateGPT versions up to and including 0.6.2.
What type of vulnerability is CVE-2025-4515?
CVE-2025-4515 is a cross-domain policy vulnerability that allows permissive access to untrusted domains.
Can CVE-2025-4515 lead to exploitation?
Yes, CVE-2025-4515 can potentially lead to exploitation by allowing unauthorized requests from untrusted sources.