CVE-2025-61768 Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload
An administrator can upload a malicious SVG file to trigger server-side requests, enabling internal network probing and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61768?
CVE-2025-61768 is a medium-severity server-side request forgery vulnerability in xuemian168 kuno, published on 6 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external image reference, causing the server to initiate an outgoing connection to an arbitrary external URL. This can lead to information disclosure or internal network probing. Version 1.3.15 contains a fix for the issue.
Which versions are affected by CVE-2025-61768?
How do I fix CVE-2025-61768?
No fix has been published for CVE-2025-61768 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-61768 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61768 exists.
Sources
Also known as GHSA-4f5f-2c49-5mwm.