CVE-2025-67427
Medium · 6.5evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API
CVSS
6.5
EPSS
0.2%
Published
Jan 5, 2026
CISA due date
—
The record
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @evershop/evershop | 0 | No fix |
Related vulnerabilities
- GHSA-vp8w-wj4m-3r7j evershop allows unauthenticated attackers to force server to initiate HTTP request via… Same vulnerability
- GHSA-m2q5-xhqg-92r2 evershop allows unauthenticated attackers to exhaust application server's resources via… Also affects @evershop/evershop
- CVE-2025-67419 evershop allows unauthenticated attackers to exhaust application server's resources via… Also affects @evershop/evershop
- GHSA-c73g-mx2w-cc93 EverShop is vulnerable to Unauthorized Order Information Access (IDOR) Also affects @evershop/evershop
- CVE-2025-12919 A vulnerability was detected in EverShop up to 2.0.1. Also affects @evershop/evershop
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918