FastGPT CVE-2025-62612

Exploitation requires the attacker to control the URL/network link passed to FastGPT's workflow file-reading node in a version prior to 4.11.1; the node fetches the link without security validation (no allow-list/SSRF filtering). The CVSS vector lists PR:N/UI:N (no privileges or user interaction), but in practice reaching the workflow file-reading node generally requires access to the workflow builder, which in standard FastGPT deployments is behind authentication - this is a key LIMITING factor to confirm per deployment. Real-world impact also depends on the server's network position: SSRF value is highest when the FastGPT host can reach internal-only services or cloud metadata endpoints; an egress-filtered or isolated deployment sharply limits exploitability.

This is a moderate-risk SSRF (CWE-918) in FastGPT's workflow file-reading node, affecting versions prior to 4.11.1. The signals point to a real but non-critical issue rather than an emergency. The vendor-supplied CVSS 4.0 vector (6.9) models the impact as subsequent-system confidentiality only (SC:L; VC:N/VI:N/VA:N), which is consistent with a classic SSRF: the attacker does not directly compromise the FastGPT host but can coerce it into making requests to internal/third-party systems, leaking limited information (e.g., internal service responses or cloud metadata). EPSS is low at 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation - exploitation status is best described as 'no public exploit identified at time of analysis.' CONFLICT TO VERIFY: the CVSS vector specifies PR:N (unauthenticated), yet the vulnerable surface is the workflow authoring/file-reading node, which in FastGPT typically requires an authenticated account to configure a workflow with an attacker-controlled URL - verify with the GitHub advisory whether the node is reachable pre-auth or whether PR should be PR:L. Overall this is a legitimate but lower-tier priority: patch in normal cycles, prioritize sooner if the FastGPT instance can reach sensitive internal networks or cloud metadata endpoints.

An attacker who can define or influence a FastGPT workflow supplies a malicious URL (e.g., an internal address or a cloud metadata endpoint like 169.254.169.254) to the file-reading node, which fetches it without security validation. The server then issues the request from its own trusted network position, allowing the attacker to probe internal services or retrieve internal responses. No public exploit code was identified at time of analysis.