CVE-2025-59146
BaseFortify
Publication date: 2025-10-09
Last updated on: 2025-10-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| quantumnous | new-api | 0.9.0.4 |
| quantumnous | new-api | 0.9.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authenticated Server-Side Request Forgery (SSRF) in the New API system, which is a large language model gateway and AI asset management system. Authenticated users can submit a URL for the server to process, but the application does not properly validate these URLs before making server-side requests. This allows an attacker to craft malicious URLs that cause the server to send requests to arbitrary internal or external services, potentially exposing sensitive information or enabling further attacks. The vulnerability affects versions prior to 0.9.0.5 and has been patched in that version by adding a user-configurable SSRF protection module.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with authenticated access to coerce the server into making requests to arbitrary internal or external services. This can lead to unauthorized access to internal resources, data leakage, or interaction with unintended services. Since the vulnerability allows high-impact confidentiality breaches (as indicated by the CVSS score), it can compromise sensitive data and potentially facilitate further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should upgrade to version 0.9.0.5 or later where the vulnerability is patched. If upgrading is not possible right away, enable the new-api image processing worker (new-api-worker) and/or configure egress firewall rules to restrict outbound requests from the server.