CVE-2025-52186

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-13 · updated 2026-06-17
Weakness: CWE-918

Description

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs

Affected products

lichess-org lila: before 2025-06-02 — fixed in 2025-06-02

How to fix

Upgrade to a fixed version: lichess-org lila 2025-06-02. Check the vendor advisory for mitigations.

References

https://github.com/lichess-org/lila/commit/11b4c0fb00f0ffd8232346f839627005459c8f05c
https://hackerone.com/reports/3165242

Get alerted when CVE-2025-52186 or the next vulnerability affects your stack