CVE-2025-52186

Published: Nov 13, 2025Modified: Jan 9, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs

Affected (1)

Products: Lichess: Lila

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lichess Lila	Before 2025-06-02

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://github.com/lichess-org/lila/commit/11b4c0fb00f0ffd8232346f839627005459c8f05c

Source: cve@mitre.org

Broken Link

https://hackerone.com/reports/3165242

Source: cve@mitre.org

ExploitIssue Tracking

Timeline

No history available yet.