evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API

Description

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server’s resources via the “GET /images” API.

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.1.0

References

GHSA-m2q5-xhqg-92r2
pages.dos-m0nk3y.com
CVE-2025-67419
CWE-1050
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API and gives you actionable findings to investigate.

Start a free scan

Related Issues

evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API - CVE-2025-67427
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint - CVE-2025-48996
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

Exploiting Server Version Disclosure

See something that needs correcting? Let us knowUpdated January 05, 2026