GHSL-2024-161: _GHSL-2024-162: Server-Side Request Forgery (SSRF) and a weak default CORS configuration in rembg - CVE-2025-25301, CVE-2025-25302

Published Feb 27, 2025

Updated

rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration, which may allow an attacker website to send requests to servers on the internal network and view image responses.

Affected Software

1 affected component

pypi/rembg

Event History

Feb 27, 2025

Advisory Published

via GitHub Security Lab·12:00 AM

Data Sourced

via GitHub Security Lab·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running the rembg server are affected. The issue involves the server's ability to make requests to internal-network servers and its weak default CORS configuration.

What does an attacker need to exploit it?

An attacker can use a website to send requests through the vulnerable rembg server. The described impact includes accessing servers on the internal network and viewing image responses.

Is the default configuration relevant?

Yes. The issue specifically identifies a weak default CORS configuration, so deployments using the default CORS behavior are relevant to triage.

GHSL-2024-161: _GHSL-2024-162: Server-Side Request Forgery (SSRF) and a weak default CORS configuration in rembg - CVE-2025-25301, CVE-2025-25302

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Is the default configuration relevant?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Is the default configuration relevant?