CVE-2025-60319
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).
Risk Assessment
An attacker can force the server to make requests to arbitrary internal or external resources, potentially leading to information disclosure or attacks on other systems.
Recommendation
Update PerfreeBlog to a patched version or implement additional authorization checks for the uploadAttachByUrl endpoint.
Other vulnerabilities in PerfreeBlog
See all- CVE-2025-60735High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installPlugin function. This allows an attacker to upload a malicious file to the server.
- CVE-2025-60731High
PerfreeBlog version 4.0.11 has a file upload vulnerability in the installTheme function. This flaw allows an attacker to upload a malicious file to the server.
- CVE-2025-60730High
PerfreeBlog version 4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function. An attacker can exploit this flaw to delete arbitrary files on the server.
- CVE-2025-60729Medium
PerfreeBlog version 4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function. It allows an attacker to read arbitrary files on the server.
Original NVD description (English source)
PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS