CVE-2025-60279

9.6 criticalEPSS 0.4%

Critical (9.6). EPSS 0.4% chance of exploitation in the next 30 days.

A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API. An attacker can leverage this to enumerate open ports based on response discrepancies and interact with internal services.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2025-10-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-60279.pdf
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

Check your stack JSON