CVE-2025-27232CWE-918ssrf

CVE-2025-27232

Medium · published December 1, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-12-01T18:16Z
Affected products (1)
ProductVersionsFixed in
zabbix/frontend≥ 7.4.0, < 7.4.37.4.3
References (1)
https://support.zabbix.com/browse/ZBX-27282 · [email protected]
EPSS history
Timeline
  • 01 DEC 12:55Z
    Frontend arbitrary file read in oauth.authorize action
    cvelistv5