CVE-2025-6242

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

• CWE-918

• https://access.redhat.com/security/cve/CVE-2025-6242
• https://bugzilla.redhat.com/show_bug.cgi?id=2373716

Published

Oct 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62414Bagisto is an open source laravel eCommerce platform. In Bag…4.8
• CVE-2025-62415Bagisto is an open source laravel eCommerce platform. In Bag…4.8
• CVE-2025-62416Bagisto is an open source laravel eCommerce platform. Bagist…6.8
• CVE-2025-62417Bagisto is an open source laravel eCommerce platform. When p…7.8
• CVE-2025-62418Bagisto is an open source laravel eCommerce platform. In Bag…4.8
• CVE-2025-62419DataEase is a data visualization and analytics platform. In …7.5
• CVE-2025-62420DataEase is a data visualization and analytics platform. In …8.8
• CVE-2025-62421DataEase is a data visualization and analytics platform. In …5.4
• CVE-2025-62422DataEase is an open source data visualization and analytics …8.8
• CVE-2025-62423ClipBucket V5 provides open source video hosting with PHP. I…7.2
• CVE-2025-62424ClipBucket is a web-based video-sharing platform. In ClipBuc…6.5
• CVE-2025-62425MAS (Matrix Authentication Service) is a user management and…8.3