CVE-2025-25194: Server-Side Request Forgery (SSRF) in activitypub_federation

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-10 · updated 2026-06-17
Weakness: CWE-918

Description

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypub_federation and versions 0.19.8 and prior of Lemmy, allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request. As of time of publication, a fix has not been made available.

Affected products

LemmyNet lemmy: through 0.19.8

References

https://github.com/LemmyNet/lemmy/security/advisories/GHSA-7723-35v7-qcxw

Get alerted when CVE-2025-25194 or the next vulnerability affects your stack