FastGPT — Ssrf (CVE-2025-62612)
Date: 2025-10
Affected: fastgpt/fastgpt
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-62612
CWE: CWE-918
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link is not security-verified, posing a risk of SSRF attacks. This issue has been patched in version 4.11.1.


Mitigations:

Architectural layers (MAESTRO):