Description
Flowise 低代码平台的 /api/v1/fetch-links 接口未对用户输入的 URL 参数进行严格验证，允许攻击者构造恶意请求访问内部或外部系统资源，存在服务器端请求伪造（SSRF）漏洞（CVE-2025-59527）。
Flowise /api/v1/fetch-links 服务器端请求伪造漏洞 （CVE-2025-59527）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-59527
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m
https://www.miggo.io/vulnerability-database/cve/CVE-2025-59527
https://access.redhat.com/security/cve/cve-2025-59527
https://www.tenable.com/cve/CVE-2025-59527
https://www.sentinelone.com/vulnerability-database/cve-2025-59527/
https://www.ameeba.com/blog/cve-2025-59527-server-side-request-forgery-vulnerability-in-flowise-application/
https://www.kodemsecurity.com/cve-database/cve-2025-59527