What is the CVSS score of CVE-2025-50228?

CVE-2025-50228 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of User Evaluation are affected by CVE-2025-50228?

Jizhicms v2.5.4 contains a critical Server-Side Request Forgery vulnerability (CVSS 9.1) in its User Evaluation, Message, and Comment modules that allows unauthenticated attackers to make arbitrary…

How to fix or mitigate CVE-2025-50228?

24 hours: Identify all Jizhicms v2.5.4 instances in production and take inventory of their network position and data exposure scope. Disable or restrict network access to the User Evaluation, Message, and Comment modules via Web Application Firewall rules or reverse proxy configurations. 7 days: Implement egress filtering to block outbound HTTP/HTTPS requests from Jizhicms servers to internal networks (RFC 1918 ranges) and cloud metadata endpoints (169.254.169.254, 169.254.170.2). Establish network segmentation isolating Jizhicms from sensitive internal systems. Evaluate migration to a patched alternative CMS or contact Jizhicms vendor for patch timeline. 30 days: Complete migration off Jizhicms v2.5.4 to a supported version once patches are released and validated, or transition to alternative CMS platform. Conduct forensic review of server logs for evidence of SSRF exploitation attempts.

User Evaluation CVE-2025-50228

EUVD-2025-209380 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-09 mitre

GHSA-3hh3-hx7r-ggc2

SSRF

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:22 vuln.today

CVSS changed

Apr 14, 2026 - 17:22 NVD

9.1 (CRITICAL)

EUVD ID Assigned

Apr 09, 2026 - 15:00 euvd

EUVD-2025-209380

CVE Published

Apr 09, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

AnalysisAI

Server-Side Request Forgery in Jizhicms v2.5.4 allows unauthenticated remote attackers to abuse User Evaluation, Message, and Comment modules to make arbitrary HTTP requests from the server. With critical CVSS 9.1 (AV:N/AC:L/PR:N/UI:N), attackers can achieve high confidentiality and integrity impact without authentication. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, and no vendor-released patch confirmed

Technical ContextAI

Server-Side Request Forgery (CWE-918) occurs when an application accepts user-controlled URLs and makes HTTP requests without proper validation of the destination. Jizhicms is a PHP-based content management system, and version 2.5.4 contains SSRF vulnerabilities in three distinct modules: User Evaluation, Message, and Comment. These modules likely accept URL parameters for features such as avatar fetching, link previews, or webhook callbacks without validating that the target is an external, safe resource. This allows attackers to force the server to make requests to arbitrary destinations including localhost (127.0.0.1), internal RFC1918 networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), cloud metadata endpoints (169.254.169.254), or internal services. The vulnerability affects the product identified in CPE namespace a:n/a:n/a, indicating limited vendor coordination. The CVSS vector shows network-based attack with low complexity and no required privileges, making this trivially exploitable by any remote attacker.

RemediationAI

Organizations running Jizhicms v2.5.4 should monitor the official GitHub repository (github.com/Cherry-toto/jizhicms) and vendor website (jizhicms.cn) for security updates addressing CVE-2025-50228. Review GitHub issue #104 (github.com/Cherry-toto/jizhicms/issues/104) for vulnerability details and potential community-provided patches. No vendor-released patch independently confirmed at time of analysis. Immediate mitigations include implementing network-level controls to prevent the application server from making outbound requests to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) through egress filtering or web application firewall rules. For cloud deployments, block access to metadata endpoints (169.254.169.254, fd00:ec2::254) at the network or host firewall level. Conduct input validation audits of User Evaluation, Message, and Comment modules, implementing allowlists for permitted external domains and URL schema restrictions (limit to http/https, block file://, gopher://, dict://, etc.). Consider disabling vulnerable modules if not operationally required until patches are available. Implement defense-in-depth by running the application with minimal network permissions and using network segmentation to isolate CMS infrastructure from sensitive internal services.