CVE-2025-6242
High
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.
SeverityHigh
CVSS7.1
Exploit probability—
ProductVllm
PublishedOct 7, 2025
First seenOct 7, 2025
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- vllm0.11.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vllmPyPI | 0.5.0 ≤ v < 0.11.0 | 0.11.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.