evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API

Description

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the “GET /images” API.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.1.0

References

• GHSA-vp8w-wj4m-3r7j
• pages.dos-m0nk3y.com
• CVE-2025-67427
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API - CVE-2025-67419
• Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179
• Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611
• Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint - CVE-2025-48996

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@evershop/evershop