CVE-2025-13789CWE-918ssrf

CVE-2025-13789

Medium · published November 30, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6 mitigates this issue. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-11-30T19:16Z
Affected products (1)
ProductVersionsFixed in
zentao/zentao< 21.7.621.7.6
References (7)
https://github.com/ez-lbz/ez-lbz.github.io/issues/2 · [email protected]https://github.com/ez-lbz/ez-lbz.github.io/issues/2#issue-3598317459 · [email protected]https://github.com/ez-lbz/ez-lbz.github.io/issues/2#issuecomment-3540247346 · [email protected]https://vuldb.com/?ctiid.333793 · [email protected]https://vuldb.com/?id.333793 · [email protected]https://vuldb.com/?submit.690728 · [email protected]https://www.zentao.net/extension-viewext-6.html · [email protected]
EPSS history
Timeline
  • 30 NOV 13:32Z
    ZenTao model.php makeRequest server-side request forgery
    cvelistv5