CVE-2025-57818

Firecrawl SSRF Vulnerability via malicious webhook

CVSS 6.3 MEDIUMEPSS 0.3%CWE-918

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Aug 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

firecrawl · firecrawl

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/firecrawl/firecrawl/commit/b15fae51a760e9810a66bbfde5d5693d0df3fbeb https://github.com/firecrawl/firecrawl/commit/e8cf0985b07968061a6b684b58097732e827ed46 https://github.com/firecrawl/firecrawl/releases/tag/v2.0.1 https://github.com/firecrawl/firecrawl/security/advisories/GHSA-p2wg-prhf-jx79