CVE-2025-59346 Dragonfly server-side request forgery vulnerability
Attackers can force Dragonfly components to access internal services via weak URL validation in the Manager API, enabling internal network probing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59346?
CVE-2025-59346 is a medium-severity server-side request forgery vulnerability in dragonflyoss dragonfly, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to them. The issue arises because the Manager API accepts a user-supplied URL when creating a Preheat job with weak validation, peers can trigger other peers to fetch an arbitrary URL through pieceManager.DownloadSource, and internal HTTP clients follow redirects, allowing a request to a malicious server to be redirected to internal services. This can be used to probe or access internal HTTP endpoints. The vulnerability is fixed in version 2.1.0.
Weakness: CWE-918
Which versions are affected by CVE-2025-59346?
6 open source packages ship an affected version, including github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dragonflyoss/dragonfly Go | All versions | None |
github.com/dragonflyoss/dragonfly Go | All versions | 2.1.0 |
github.com/dragonflyoss/dragonfly Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
Products include Linuxfoundation Dragonfly.
How do I fix CVE-2025-59346?
Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-59346 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59346 exists.
Other vulnerabilities in dragonflyoss dragonfly
- CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key
- CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access
- CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints
- CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses
- CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine
Sources
Also known as GHSA-g2rq-jv54-wcpr, GO-2025-3968.