Server-Side Request Forgery Vulnerability in AliasVault Password Manager
CVE-2025-59344

7.7HIGH

Key Information:

Vendor

Aliasvault

Status
Aliasvault
Vendor
CVE Published:
19 September 2025

What is CVE-2025-59344?

AliasVault, a privacy-first password manager, contains a server-side request forgery (SSRF) vulnerability in its favicon extraction feature. In API versions 0.23.0 and lower, the exploitable URL fetching mechanism accepts user-supplied URLs and follows redirects without sufficient internal IP protections. This allows authenticated, low-privileged users to manipulate the backend, potentially accessing arbitrary internal resources. Attackers can receive responses in Base64 format, or even utilize timing and error responses to glean information about internal services. This flaw impacts only self-hosted instances of AliasVault that allow public user registration and are accessible from the internet. Users are urged to upgrade to AliasVault release 0.23.1 or higher to mitigate this issue.

Affected Version(s)

aliasvault < 0.23.1

References

https://github.com/aliasvault/aliasvault/security/advisor...
x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/pull/1226
x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/58c39815e...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59344 : Server-Side Request Forgery Vulnerability in AliasVault Password Manager