Vulnerability details

CVE-2025-53371

miraheze DiscordNotifications

DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs

CVSS 3.1

9.1Critical

Official description

DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. This allows for DOS by causing the server to read large files. SSRF is also possible if there are internal unprotected APIs that can be accessed using HTTP POST requests, which could also possibly lead to RCE. This vulnerability is fixed in commit 1f20d850cbcce5b15951c7c6127b87b927a5415e.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H`

Affected products

Vendor	Product	Versions	Source
miraheze	DiscordNotifications	< 1f20d850cbcce5b15951c7c6127b87b927a5415e	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/miraheze/DiscordNotifications/security/advisories/GHSA-gvfx-p3h5-qf65 x_refsource_CONFIRM
https://github.com/miraheze/DiscordNotifications/commit/1f20d850cbcce5b15951c7c6127b87b927a5415e x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-07-10
Last updated: 2025-07-10
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.38%

Probability of exploitation in 30 days

32.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-400
Uncontrolled Resource Consumption
CWE-918
Server-Side Request Forgery (SSRF)