CVE-2025-61784 LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities

What is CVE-2025-61784?

CVE-2025-61784 is a high-severity server-side request forgery vulnerability in hiyouga LLaMA-Factory, published on 7 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or interaction with third-party services. The same mechanism also allows for a Local File Inclusion (LFI) vulnerability, enabling users to read arbitrary files from the server's filesystem. The vulnerability exists in the `_process_request` function within `src/llamafactory/api/chat.py.` This function is responsible for processing incoming multimodal content, including images, videos, and audio provided via URLs. The function checks if the provided URL is a base64 data URI or a local file path (`os.path.isfile`). If neither is true, it falls back to treating the URL as a web URI and makes a direct HTTP GET request using `requests.get(url, stream=True).raw` without any validation or sanitization of the URL. Version 0.9.4 fixes the underlying issue.

Weakness: CWE-918, CWE-22

Which versions are affected by CVE-2025-61784?

3 open source packages ship an affected version, including llamafactory. It affects 1 product.

Products include Hiyouga Llama-Factory.

How do I fix CVE-2025-61784?

Upgrade llamafactory to 0.9.4 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-61784 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61784 exists.

Other vulnerabilities in hiyouga LLaMA-Factory

• CVE-2026-58116 LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path Critical 9.3
• CVE-2025-53002 LLaMA-Factory Remote Code Execution (RCE) Vulnerability High 8.3
• CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability High 7.5
• CVE-2025-46567 LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-527m-2xhr-j27g, PYSEC-2026-1573.