CVE-2025-8133

A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file app/modules/api/service/gather.js. The manipulation of the argument targetUrl leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The identifier of the patch is 3ef58a50e8b3c427b03c8cf3c9e19a79aa809be6. It is recommended to upgrade the affected component.

• CWE-918

• https://gitee.com/yanyutao0402/ChanCMS/commit/3ef58a50e8b3c427b03c8cf3c9e19a79aa809be6Permissions Required
• https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP1KExploit, Issue Tracking
• https://gitee.com/yanyutao0402/ChanCMS/releases/tag/V3.1.3Release Notes
• https://vuldb.com/?ctiid.317529Permissions Required, VDB Entry
• https://vuldb.com/?id.317529Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.619777Third Party Advisory, VDB Entry
• https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP1KExploit, Issue Tracking

Published

Jul 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8127A vulnerability classified as critical was found in deerwms …8.8
• CVE-2025-8128A vulnerability, which was classified as critical, has been …6.3
• CVE-2025-8129A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2025-8130Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-8131A vulnerability was found in Tenda AC20 16.03.08.05. It has …8.8
• CVE-2025-8132A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.…5.4
• CVE-2025-8134A vulnerability classified as critical was found in PHPGuruk…8.8
• CVE-2025-8135A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-8136A vulnerability, which was classified as critical, was found…7.5
• CVE-2025-8137A vulnerability has been found in TOTOLINK A702R 4.0.0-B2023…8.8
• CVE-2025-8138A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.…8.8
• CVE-2025-8139A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.…8.8