CVE-2025-58962

MediumCVSS 6.4

Published: 22/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The Publitio plugin (versions up to 2.2.1) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force server-side requests to arbitrary resources.

Risk Assessment

An attacker could use the server to scan internal networks or access services not exposed externally, potentially leading to data leakage or further escalation.

Recommendation

Update the Publitio plugin to the latest version (above 2.2.1) or disable it if updating is not possible.

Other vulnerabilities in Publitio

CVE-2025-62947Medium
The Publitio plugin in versions up to 2.2.5 contains an Insertion of Sensitive Information Into Sent Data vulnerability. This may allow retrieval of embedded sensitive data.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through <= 2.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS