CVE-2025-67427

6.5 mediumEPSS 0.2%

Medium (6.5) in evershop evershop. EPSS 0.2% chance of exploitation in the next 30 days.

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-01-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

evershop:evershop

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vp8w-wj4m-3r7j	npm	@evershop/evershop	<=2.1.0	no fix published

References

https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67427
https://github.com/evershopcommerce/evershop

Check your stack JSON