CVE-2025-60898: SSRF
An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a user-supplied URI without adequate allow/blocklist validation and returns a 307 redirect that can disclose internal URLs in the Location header.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60898?
CVE-2025-60898 is rated as a critical severity vulnerability due to its potential for remote exploitation.
What does CVE-2025-60898 allow an attacker to do?
CVE-2025-60898 allows an attacker to perform server-side request forgery, enabling them to access internal resources by sending requests to attacker-controlled URLs.
How can I prevent CVE-2025-60898 in my Halo CMS installation?
To prevent CVE-2025-60898, ensure you apply the latest security patches released by Halo and restrict external URL access for the Thumbnail via-uri endpoint.
Is CVE-2025-60898 specific to certain versions of Halo CMS?
Yes, CVE-2025-60898 specifically affects Halo CMS 2.21 and potentially earlier versions that utilize the Thumbnail via-uri endpoint.
Are there any mitigations for CVE-2025-60898 before patching?
Before patching for CVE-2025-60898, restrict access to the vulnerable endpoint and monitor for unusual outbound requests.