CVE-2025-54122

CRITICAL EPSS 53.5%

Published Jul 21, 202511mo ago · Modified Jun 17, 20261w ago

10.0 CVSS 3.1

Critical

Published Jul 21, 2025 11mo ago

Last Modified Jun 17, 2026 1w ago

Description

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and exfiltration of sensitive data from isolated network segments. This vulnerability is fixed in version 25.7.21.2525.

CVSS Details

Base Score

10.0

Exploitability

3.9

Impact

6.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

53.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

References 1

github.com https://github.com/Manager-io/Manager/security/advisories/GHSA-347w-cgwh-m895

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.