Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint

xbow.com | vulnerability | Medium | CVE-2025-27888 | #zero-day | #vulnerability-research | #ssrf | #url-parsing | #cve-2025-27888 | #apache-druid

Summary

Recounts how XBOW turned knowledge of older CVEs into a new Apache Druid zero-day SSRF (CVE-2025-27888), triggered through a proxy endpoint and URL parsing confusion.
CVSS
5.8
Published
Collected

original ↗

Related coverage

  1. Claude Mythos: Preparing for a World Where AI Finds and Exploits Vulnerabilities Faster Than Ever (wiz.io)
  2. Introducing AI Cyber Model Arena: A Real-World Benchmark for AI Agents in Cybersecurity (wiz.io)
  3. Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle (xbow.com)
  4. SSRF & URI Validation Bypass in 2FAuth (xbow.com)
  5. Unauthorized RCE in VMware vCenter (swarm.ptsecurity.com)
  6. ShieldCrash: Windows Defender 0-Day PoC Bypassing ShieldBreak (CVE-2026-69414) Patch (github.com)

back