CVE-2025-60898 Server-side request forgery in n/a
Unauthenticated attackers can exploit Halo CMS to perform server-side requests and disclose internal URLs via the Thumbnail via-uri endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-60898?
CVE-2025-60898 is a medium-severity server-side request forgery vulnerability in n/a, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a user-supplied URI without adequate allow/blocklist validation and returns a 307 redirect that can disclose internal URLs in the Location header.
Weakness: CWE-918
Which versions are affected by CVE-2025-60898?
How do I fix CVE-2025-60898?
No fix has been published for CVE-2025-60898 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-60898 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60898 exists.
Sources
Also known as GHSA-c5jc-gcgx-fp5c.