CVE-2025-62612CWE-918ssrf

CVE-2025-62612

Medium · published October 23, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
14.0
In the wild
Unconfirmed
What it is

FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link is not security-verified, posing a risk of SSRF attacks. This issue has been patched in version 4.11.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00238 · 14.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-10-23T01:15Z
Affected products (1)
ProductVersionsFixed in
fastgpt/fastgpt< 4.11.14.11.1
References (1)
https://github.com/labring/FastGPT/security/advisories/GHSA-573g-3567-8phg · [email protected]
EPSS history
Timeline
  • 22 OCT 20:45Z
    FastGPT File Reading Node SSRF Vulnerability
    cvelistv5