CVE-2025-11046CWE-918ssrf

CVE-2025-11046

High · published September 27, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. It is advisable to upgrade the affected component. The vendor responds: "We have confirmed that the issue mentioned in the report does not exist in the latest releases".

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00473 · 40.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-27T01:15Z
Affected products (1)
ProductVersionsFixed in
tencent/weknoraall versions—
References (6)
https://github.com/Hebing123/cve/issues/90 · [email protected]https://vuldb.com/?ctiid.326083 · [email protected]https://vuldb.com/?id.326083 · [email protected]https://vuldb.com/?submit.658926 · [email protected]https://github.com/Hebing123/cve/issues/90 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://vuldb.com/?submit.658926 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 SEP 21:02Z
    Tencent WeKnora test testEmbeddingModel server-side request forgery
    cvelistv5