CVE-2025-61768 - CVE House
Back to Database
Status published Medium CVE-2025-61768

Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload

Vulnerability Description

KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external image reference, causing the server to initiate an outgoing connection to an arbitrary external URL. This can lead to information disclosure or internal network probing. Version 1.3.15 contains a fix for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61768

Credits & Attribution

No credits recorded in the NVD database.

References

More from xuemian168

View All →
CVE-2025-61681
Kuno is Vulnerable to Stored XSS Attack via SVG File Upload
Medium 5.4

Affected Vendor

Affected Software

kuno
Vulnerable Versions:
< 1.3.15

Timeline

Official Publish: October 6th, 2025
Last Modified: October 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-20 CWE-434 CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery