CVE-2025-67427 evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API

What is CVE-2025-67427?

CVE-2025-67427 is a medium-severity server-side request forgery vulnerability in n/a, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

Weakness: CWE-918

Which versions are affected by CVE-2025-67427?

2 open source packages ship an affected version, including @evershop/evershop. It affects 1 product.

Products include Evershop Evershop.

How do I fix CVE-2025-67427?

No fix has been published for CVE-2025-67427 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-67427 being exploited?

There is no known exploitation of CVE-2025-67427 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-28213 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response Critical 9.8
• CVE-2023-46498 Code execution in evershop Critical 9.8
• CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys Critical 9.3
• CVE-2023-46943 EverShop at risk to unauthorized access via weak HMAC secret Critical 9.1
• CVE-2023-46496 Directory Traversal in evershop High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vp8w-wj4m-3r7j.