p PatchFirst

CVE-2025-25301

CVE-2025-25301 · Rembg allows SSRF via /api/remove

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.

CVSS 6.9 · Media · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • rembg

    Versiones
    • <= 2.0.57: Afectada

    Sin corrección publicada

  • rembg PyPI

    Versiones
    • 2.0.28
    • 2.0.29
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.36
    • 2.0.37
    • 2.0.38
    • 2.0.39
    • 2.0.40
    • 2.0.41
    • 2.0.43
    • 2.0.44
    • 2.0.45
    • 2.0.46
    • 2.0.47
    • 2.0.48
    • 2.0.49
    • 2.0.50
    • 2.0.51
    • 2.0.52
    • 2.0.53
    • 2.0.54
    • 2.0.55
    • 2.0.56
    • 2.0.57
    Intervalos de versiones afectados
    • ECOSYSTEM: ≤ 2.0.57

    Sin corrección publicada

  • rembg PyPI

    Versiones
    • 2.0.28
    • 2.0.29
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.36
    • 2.0.37
    • 2.0.38
    • 2.0.39
    • 2.0.40
    • 2.0.41
    • 2.0.43
    • 2.0.44
    • 2.0.45
    • 2.0.46
    • 2.0.47
    • 2.0.48
    • 2.0.49
    • 2.0.50
    • 2.0.51
    • 2.0.52
    • 2.0.53
    • 2.0.54
    • 2.0.55
    • 2.0.56
    • 2.0.57
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.0.58

    Actualiza a 2.0.58

Fuentes originales

Comprueba tu servidor →