PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint

xbow.com | vulnerability | Medium | CVE-2025-27888 | #zero-day | #vulnerability-research | #ssrf | #url-parsing | #cve-2025-27888 | #apache-druid
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recounts how XBOW turned knowledge of older CVEs into a new Apache Druid zero-day SSRF (CVE-2025-27888), triggered through a proxy endpoint and URL parsing confusion.
CVE
CVE-2025-27888
CVSS
5.8
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
vulnerability · volexity.com
[CVE-2026-85046] Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
# Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP October 16, 2026 Volexity Volcano Team Last month, Volexity published two blog posts in its _Mind the (Patch)...
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
Critical · vulnerability · github.com
gVisor Sandbox Escape PoC: Host Root RCE via directfs openHandle Type Confusion
Demonstrates a complete, verified sandbox escape against gVisor container runtimes by chaining file system descriptor race conditions with host udev device probing to break container isolation completely.
vulnerability · yokai.hakaisecurity.io
[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)
# [Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643) RESEARCHER **Gabriel Alves** READ TIME**6 MINUTES** PUBLISHED**01 Oct 2026**...
Back