CVE-2025-53371

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53371

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53371.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53371

Aliases

GHSA-gvfx-p3h5-qf65

Published

2025-07-10T17:26:02.512Z

Modified

2026-04-02T12:52:43.202306Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H CVSS Calculator

Summary

DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs

Details

DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and filegetcontents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. This allows for DOS by causing the server to read large files. SSRF is also possible if there are internal unprotected APIs that can be accessed using HTTP POST requests, which could also possibly lead to RCE. This vulnerability is fixed in commit 1f20d850cbcce5b15951c7c6127b87b927a5415e.

Database specific

{
    "cwe_ids": [
        "CWE-400",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53371.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/miraheze/discordnotifications

Affected ranges

Type: GIT
Repo: https://github.com/miraheze/discordnotifications
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1f20d850cbcce5b15951c7c6127b87b927a5415e

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53371.json"