CVE-2025-45872

NVD	https://nvd.nist.gov/vuln/detail/CVE-2025-45872
CWE	https://cwe.mitre.org/data/definitions/918.html

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-45872

CWE

https://cwe.mitre.org/data/definitions/918.html

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.

Weakness

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://cwe.mitre.org/data/definitions/664.html

References

https://github.com/dengxmenglihua/cve/blob/main/ZrLog%20Blog%20System%20SSRF%20%2B%20File%20Overwrite%20Leading%20to%20RCE%20Vulnerability.md
https://github.com/dengxmenglihua/cve/blob/main/ZrLog%20Blog%20System%20SSRF%20%2B%20File%20Overwrite%20Leading%20to%20RCE%20Vulnerability.md

Server-Side Request Forgery (SSRF)

Weakness

Related Attack Patterns

References