CVE-2025-57818: Firecrawl SSRF Vulnerability via malicious webhook
Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57818?
CVE-2025-57818 has been classified as a high severity vulnerability due to its potential for server-side request forgery (SSRF) attacks.
How do I fix CVE-2025-57818?
To fix CVE-2025-57818, upgrade Firecrawl to version 2.0.1 or later.
Who is affected by CVE-2025-57818?
Authenticated users of Firecrawl versions prior to 2.0.1 are affected by CVE-2025-57818.
What functionality is impacted by CVE-2025-57818?
CVE-2025-57818 impacts Firecrawl's webhook functionality, which can be exploited for SSRF.
What is the recommended action if I cannot upgrade Firecrawl due to CVE-2025-57818?
If unable to upgrade, consider implementing network controls to restrict access to internal URLs to mitigate CVE-2025-57818.