CVE-2025-4012 playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery
Attackers can exploit a server-side request forgery vulnerability in the user avatar creation endpoint to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4012?
CVE-2025-4012 is a medium-severity server-side request forgery vulnerability in playeduxyz PlayEdu 开源培训系统, published on 28 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in playeduxyz PlayEdu 开源培训系统 up to 1.8 and classified as problematic. This issue affects some unknown processing of the file /api/backend/v1/user/create of the component User Avatar Handler. The manipulation of the argument Avatar leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-918
Which versions are affected by CVE-2025-4012?
It affects 1 product.
Products include Playeduos Playedu.
How do I fix CVE-2025-4012?
No fix has been published for CVE-2025-4012 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-4012 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4012 exists.
Sources
Also known as GHSA-pfxp-h2rx-w8c2.