Server-Side Request Forgery Vulnerability in MetInfo CMS by MetInfo

CVE-2025-63551

What is CVE-2025-63551?

A vulnerability resides in the MetInfo Content Management System (CMS) due to a flaw in the XML parsing logic that can be exploited via XML External Entity (XXE) injection. By crafting a malicious XML entity, an attacker can induce the server to make HTTP requests to arbitrary addresses, leading to unauthorized access to internal networks, port scanning, or the exposure of sensitive information. This issue primarily occurs in the backend API associated with the path /admin/#/webset/?head_tab_active=0, where user-supplied XML data is processed without sufficient validation, making it critical for users to assess and mitigate potential risks.

References