CVE-2025-63551 Details
Description
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in MetInfo Content Management System (CMS) versions through 8.1. This vulnerability arises from improper handling of XML data, allowing attackers to inject malicious XML entities that can prompt the server to make HTTP requests to arbitrary internal or external addresses. Exploitation of this vulnerability could facilitate internal network reconnaissance, port scanning, or the extraction of sensitive information. The issue may be linked to a backend API associated with the path '/admin/#/webset/?head_tab_active=0', where user-supplied XML is processed.
When processing XML data, configure the parser to disable external entity processing. Additionally, consider using XML parsers that do not support or default to allowing external entity resolution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection | [email protected] | ExploitThird Party Advisory |
| https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection/blob/main/README.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | CISA-ADP |
| CWE-918 | Server-Side Request Forgery (SSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| metinfo metinfo | < 8.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 4, 2026 | Initial Analysis | [email protected] |
| Nov 7, 2025 | CVE Modified | CISA-ADP |
| Nov 6, 2025 | New CVE Received | [email protected] |