Medium severity · published Jan 5, 2026
CVE-2025-67427
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET…
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
Evershop · Evershop
through 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67427
Third Party Advisory
https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67427
Product
https://github.com/evershopcommerce/evershop
More from Evershop
9.8
CVE-2026-28213
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
9.8
CVE-2026-25993
EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
9.8
CVE-2023-46498
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file
9.1
CVE-2023-46943
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8
8.3
CVE-2023-46496
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE…