CVE-2025-34225

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `console_release` directory is reachable from the internet without any authentication. Inside that directory are dozens of PHP scripts that build URLs from user‑controlled values and then invoke either 'curl_exec()` or `file_get_contents()` without proper validation. Although many files attempt to mitigate SSRF by calling `filter_var', the checks are incomplete. Because the endpoint is unauthenticated, any remote attacker can supply a hostname and cause the server to issue requests to internal resources. This enables internal network reconnaissance, potential pivoting, or data exfiltration. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

• CWE-306
• CWE-918
• CWE-918

• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmVendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmVendor Advisory
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-03Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/vasion-print-printerlogic-ssrf-via-console-release-directoryThird Party Advisory
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-03Exploit, Third Party Advisory

Published

Sep 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3422The The Everest Forms – Contact Form, Quiz, Survey, Newslett…6.3
• CVE-2025-34220Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.3
• CVE-2025-34221Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34222Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.1
• CVE-2025-34223Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34224Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.1
• CVE-2025-34226OpenPLC Runtime v3 contains an input validation flaw in the …7.1
• CVE-2025-34227Nagios XI < 2026R1 is vulnerable to an authenticated command…8.8
• CVE-2025-34228Vasion Print (formerly PrinterLogic) Virtual Appliance Host …8.6
• CVE-2025-34229Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.8
• CVE-2025-3423IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cros…5.4
• CVE-2025-34230Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.8