CVE-2025-6242CWE-918ssrf

CVE-2025-6242

High · published October 8, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-10-08T00:15Z
References (2)
https://access.redhat.com/security/cve/CVE-2025-6242 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2373716 · [email protected]
EPSS history
Timeline
  • 07 OCT 19:45Z
    Vllm: server side request forgery (ssrf) in mediaconnector
    cvelistv5