Back to Database
Status published
Medium
CVE-2025-24354
imgproxy is vulnerable to SSRF against 0.0.0.0
Vulnerability Description
imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24354
Credits & Attribution
No credits recorded in the NVD database.
References
Affected Vendor
imgproxy
View all reports →Affected Software
imgproxy
Vulnerable Versions:
< 3.27.2
Timeline
Official Publish:
January 27th, 2025
Last Modified:
February 12th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N