CVE-2025-52186

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-52186

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52186.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-52186

Published

2025-11-13T00:00:00Z

Modified

2026-10-28T02:30:46Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator

Summary

[none]

Details

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs

Database specific

{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52186.json"
}

References

Affected packages

Git / github.com/lichess-org/lila

Affected ranges

Type

GIT

Repo

https://github.com/lichess-org/lila

Events

Introduced

Fixed

11b4c0fb00f0ffd823246f839627005459c8f05c

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "11b4c0fb00f0ffd823246f839627005459c8f05c"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

Other

pre-bcrypt

pre-responsive

v1.*

v1.0.0

v1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52186.json"