CVE-2025-14516CWE-918ssrf

CVE-2025-14516

Medium · published December 11, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

A vulnerability was found in Yalantis uCrop 2.2.11. Affected by this issue is the function downloadFile of the file com.yalantis.ucrop.task.BitmapLoadTask.java of the component URL Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-12-11T19:16Z
Affected products (1)
ProductVersionsFixed in
yalantis/ucropall versions—
References (5)
https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446 · [email protected]https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446?pvs=25#039fe30a92dc4ed88c9b03f85418e92e · [email protected]https://vuldb.com/?ctiid.335854 · [email protected]https://vuldb.com/?id.335854 · [email protected]https://vuldb.com/?submit.702810 · [email protected]
EPSS history
Timeline
  • 11 DEC 14:02Z
    Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery
    cvelistv5