High 7.7Published Sep 19, 2025

CVE-2025-59344AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

Updated under an hour ago (Oct 28, 2026, 12:40 AM ET)

Does this affect you?

It affects aliasvault. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for aliasvault

Exploited in the last 30 days

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows <link rel="icon" href="…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1.

CVSS: 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 19, 2025
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

aliasvault aliasvault aliasvault:aliasvault (from the name)	before 0.23.1	CNA record

References

References

https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj	x-refsource-confirm
https://github.com/aliasvault/aliasvault/pull/1226	x-refsource-misc
https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968	x-refsource-misc
https://github.com/aliasvault/aliasvault/releases/tag/0.23.1	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.