CVE-2025-54122 Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint
Unauthenticated attackers can exploit a Server-Side Request Forgery flaw to access internal services and exfiltrate sensitive data from isolated networks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54122?
CVE-2025-54122 is a critical server-side request forgery vulnerability in Manager-io Manager, published on 21 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and exfiltration of sensitive data from isolated network segments. This vulnerability is fixed in version 25.7.21.2525.
Weakness: CWE-918
Which versions are affected by CVE-2025-54122?
How do I fix CVE-2025-54122?
No fix has been published for CVE-2025-54122 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-54122 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54122 exists.
Sources
Also known as GHSA-347w-cgwh-m895.