CVE-2025-28092: ShopXO Image Upload SSRF Vulnerability
Summary
CVE-2025-28092: ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload. Affects shopxo/shopxo versions < 6.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ShopXO is an open-source e-commerce platform designed to facilitate online shopping experiences. It offers a variety of features including product management, order processing, and customer engagement tools. However, in version 6.4.0, ShopXO is vulnerable to a Server-Side Request Forgery (SSRF) through its image upload functionality, which can allow attackers to send unauthorized requests from the server.
Vulnerability Detail
The vulnerability arises from the image upload feature in ShopXO v6.4.0, which does not adequately validate the URLs of uploaded images. This oversight allows an attacker to craft a malicious image upload that triggers the server to make requests to internal or external systems. The ramifications of this vulnerability can include unauthorized access to sensitive data, potential exposure of internal services, and the ability to perform actions on behalf of the server, leading to further exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the server's ability to make outbound requests by configuring firewall rules or using network policies to limit access to sensitive internal services until a patch is applied.
Conclusion
The SSRF vulnerability in ShopXO v6.4.0 poses significant risks to users and their data. It is essential to update to a patched version to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for shopxo/shopxo →
FAQ
SSRF is a type of attack where an attacker can send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data leakage.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts can include unauthorized access to sensitive data, exposure of internal services, and the ability for attackers to perform actions on behalf of the server.
Yes, a patch is available in versions higher than 6.4.0 of ShopXO. It is crucial to update to the latest version to mitigate the risk.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for shopxo/shopxo.
