CVE-2025-24354
imgproxy is vulnerable to SSRF against 0.0.0.0
Vexday Risk Score
28Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 5.3EPSS 0.8%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
27 Jan 2025Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
imgproxy · imgproxyWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →