CVE-2025-9395

wangsongyan wblog backup.go RestorePost server-side request forgery

CVSS 5.3 MEDIUMEPSS 0.2%CWE-918

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

24 ago 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileName leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

wangsongyan · wblog

Referencias

https://github.com/on-theway/wblog/blob/main/README.md https://github.com/on-theway/wblog/blob/main/README.md#vulnerability-details-and-poc https://vuldb.com/?ctiid.321231 https://vuldb.com/?id.321231 https://vuldb.com/?submit.632367