CVE-2025-52552 - CVE House
Back to Database
Status published Medium CVE-2025-52552

FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS

Vulnerability Description

FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Improper validation and lack of sanitization of this parameter allows attackers execute malicious JavaScript or redirect them to attacker-controlled sites. This issue has been patched in version 4.9.12.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52552

Credits & Attribution

No credits recorded in the NVD database.

References

More from labring

View All →
CVE-2025-62612
FastGPT File Reading Node SSRF Vulnerability
Medium 6.9
CVE-2025-49131
FastGPT Sandbox Vulnerable to Sandbox Bypass
Medium 6.3
CVE-2025-27600
FastGPT SSRF
Medium 6.9
CVE-2023-50253
laf logs leak
Critical 9.7
CVE-2023-48225
Laf env causes sensitive information disclosure
High 8.9

Affected Vendor

Affected Software

FastGPT
Vulnerable Versions:
< 4.9.12

Timeline

Official Publish: June 21st, 2025
Last Modified: June 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-601 CWE-79

MITRE ATT&CK TTPs

T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1189 Drive-by Compromise
Initial Access
T1036 Masquerading
Defense Evasion
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact