CVE-2025-6242 – Vllm: server side request forgery (ssrf) in mediaconnector

CVE ID : CVE-2025-6242

Published : Oct. 7, 2025, 8:15 p.m. | 20 minutes ago

Description : A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project’s multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

Severity: 7.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…