CVE-2025-61768
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-06

Last updated on: 2025-10-08

Assigner: GitHub, Inc.

Description
KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external image reference, causing the server to initiate an outgoing connection to an arbitrary external URL. This can lead to information disclosure or internal network probing. Version 1.3.15 contains a fix for the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-06
Last Modified
2025-10-08
Generated
2026-06-16
AI Q&A
2025-10-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-61768
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
xuemian168 kuno *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the Media module of the KUNO CMS administrative panel in versions prior to 1.3.15. A logged-in administrator can upload a specially crafted SVG file that contains an external image reference. When processed, the server makes an outgoing connection to an arbitrary external URL specified in the SVG, which it should not normally do.

Impact Analysis

The vulnerability can lead to information disclosure or internal network probing by allowing the server to connect to arbitrary external URLs. This could expose sensitive internal network information or data to an attacker.

Mitigation Strategies

Upgrade KUNO CMS to version 1.3.15 or later, which contains a fix for the SSRF vulnerability in the Media module. Additionally, restrict administrator access to trusted users only and monitor for any unusual outgoing connections from the server.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-61768. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart