CVE-2025-57818CWE-918

Firecrawl SSRF Vulnerability via malicious webhook

Medium · published August 26, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-08-26T17:52Z
EPSS history
Timeline
  • 26 AUG 17:52Z
    Firecrawl SSRF Vulnerability via malicious webhook
    cvelistv5