CVE-2025-8529: cloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgery

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-04 · updated 2026-06-17
Weakness: CWE-918

Description

A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl of the file app/src/main/java/com/favorites/web/CollectController.java. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

cloudfavorites favorites-web: 1.0, 1.1, 1.2, 1.3.0

References

https://github.com/cloudfavorites/favorites-web/issues/134
https://github.com/cloudfavorites/favorites-web/issues/134#issue-3252105130
https://vuldb.com/?ctiid.318655
https://vuldb.com/?id.318655
https://vuldb.com/?submit.622176

Get alerted when CVE-2025-8529 or the next vulnerability affects your stack