{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-29T17:38:58.184","vulnerabilities":[{"cve":{"id":"CVE-2025-25194","sourceIdentifier":"security-advisories@github.com","published":"2025-02-10T23:15:16.067","lastModified":"2026-06-17T09:00:27.687","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypub_federation and versions 0.19.8 and prior of Lemmy, allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request. As of time of publication, a fix has not been made available."},{"lang":"es","value":"Lemmy, un agregador de enlaces y foro para el fediverso, es vulnerable a server-side request forgery a través de una dependencia de activitypub_federation, un framework para la federación de ActivityPub en Rust. Esta vulnerabilidad, que está presente en las versiones 0.6.2 y anteriores de activitypub_federation y en las versiones 0.19.8 y anteriores de Lemmy, permite a un usuario eludir cualquier ruta URL predefinida codificada o mecanismo anti-Localhost de seguridad y realizar una solicitud GET arbitraria a cualquier host, puerto y URL mediante una solicitud Webfinger. Al momento de la publicación, no se había puesto a disposición una solución."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"LemmyNet","product":"lemmy","versions":[{"version":"<= 0.19.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-11T15:19:28.876838Z","id":"CVE-2025-25194","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/LemmyNet/lemmy/security/advisories/GHSA-7723-35v7-qcxw","source":"security-advisories@github.com"}]}}]}