Server-Side Request Forgery in Dragonfly by DragonflyOSS

CVE-2025-59346

What is CVE-2025-59346?

Dragonfly, an open-source P2P-based file distribution and image acceleration system, has a vulnerability that allows attackers to exploit its Manager API. This flaw arises from insufficient validation of user-supplied URLs when creating a Preheat job. Consequently, malicious peers can induce the system to issue requests to internal services that should remain inaccessible. The vulnerability stems from internal HTTP clients following redirects, which permits probing of internal HTTP endpoints via specially crafted requests. Users are encouraged to upgrade to version 2.1.0 or later to mitigate this issue.

References