Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2025-57818

MediumPublished

Firecrawl SSRF Vulnerability via malicious webhook

Published: Aug 26, 2025
Updated: Aug 26, 2025
Assigning CNA: GitHub_M
Evidence observed: Aug 29, 2026

Primary CVSS

6.3/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS probability estimate

0.3%

Low · next 30 days

Percentile: 20.7%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.

Sources

cve-2024-56800-pocPoC
Proof-of-concept exploit demonstrating SSRF vulnerabilities in Firecrawl web scraper (CVE-2024-56800, CVE-2025-57818) with self-hosted setup and malicious redirect server.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.