CVE-2025-14516mediumCWE-918

CVE-2025-14516: falha de média gravidade em Yalantis uCrop

Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery

Publicada em

Seguir esta CVE+ Monitorar uCrop

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
A vulnerability was found in Yalantis uCrop 2.2.11. Affected by this issue is the function downloadFile of the file com.yalantis.ucrop.task.BitmapLoadTask.java of the component URL Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Yalantis · uCrop
CVEs relacionadas — Yalantis uCrop

No mesmo produto, das mais perigosas para as menos.

CVE-2025-14517MEDIUMYalantis uCrop AndroidManifest.xml UCropActivity  improper export of android application componentsEPSS 0.2%