Server-Side Request Forgery in Yifang CMS by Yifang
CVE-2025-45887

9.1CRITICAL

Key Information:

Vendor

Yifang

Status
Yifang CMS
Vendor
CVE Published:
9 May 2025

What is CVE-2025-45887?

The Yifang CMS v2.0.2 is impacted by a Server-Side Request Forgery (SSRF) vulnerability located in the /api/file/getRemoteContent endpoint. This security flaw enables attackers to send crafted requests through the server, potentially leading to unauthorized access to internal resources. As a result, sensitive data may be exposed, causing significant security risks. It is crucial for users of Yifang CMS to update their installations immediately to mitigate this vulnerability.

References

https://gitee.com/wanglongcn/yifang/issues/IBZVAG

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-45887 : Server-Side Request Forgery in Yifang CMS by Yifang