CVE-2025-10764 Overview
CVE-2025-10764 is a Server-Side Request Forgery (SSRF) vulnerability affecting SeriaWei ZKEACMS up to version 4.3. The flaw resides in the Edit function of src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs within the Event Action System component. Attackers can manipulate the Data argument to coerce the server into issuing arbitrary outbound requests. The issue is exploitable remotely and requires low privileges. According to VulDB, exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can abuse the SSRF flaw to probe internal networks, access metadata services, or interact with internal-only endpoints from the ZKEACMS server.
Affected Products
- SeriaWei ZKEACMS versions up to and including 4.3
- Component: Event Action System (ZKEACMS.EventAction)
- File: src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs
Discovery Timeline
- 2025-09-21 - CVE-2025-10764 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10764
Vulnerability Analysis
The vulnerability is classified under [CWE-918] Server-Side Request Forgery. ZKEACMS exposes an Edit endpoint in the PendingTaskController of the Event Action subsystem. The controller accepts user-supplied input through the Data parameter and uses it to issue server-side HTTP requests without sufficient validation of the target destination.
Because the request originates from the application server, an attacker can target hosts and services that are not directly reachable from the internet. This includes internal management interfaces, cloud metadata endpoints, and loopback services bound to localhost. The attack requires network access and authenticated low-privilege access to the affected endpoint.
An EPSS score of 0.411% indicates a low near-term probability of mass exploitation, but public disclosure on VulDB increases the risk of targeted abuse.
Root Cause
The root cause is missing validation and allow-listing of URLs supplied through the Data argument. The controller treats user-controlled input as a trusted request target, enabling redirection of server-issued requests to attacker-chosen destinations.
Attack Vector
An authenticated attacker sends a crafted request to the Edit action of PendingTaskController with a malicious value in the Data field. The server then issues an outbound request to the attacker-specified URL. Refer to the VulDB entry #325119 and the public technical writeup for additional reproduction details.
Detection Methods for CVE-2025-10764
Indicators of Compromise
- Outbound HTTP/HTTPS connections from the ZKEACMS application server to internal IP ranges, 127.0.0.1, or cloud metadata addresses such as 169.254.169.254.
- Web server logs containing POST requests to PendingTask/Edit with unusual URLs or IP addresses in the Data parameter.
- Unexpected DNS lookups originating from the ZKEACMS host to attacker-controlled domains.
Detection Strategies
- Inspect application logs for the PendingTaskController.Edit action and flag requests where Data contains URL schemes such as http://, https://, file://, or gopher://.
- Correlate inbound HTTP requests to the Edit endpoint with subsequent outbound connections from the ZKEACMS process.
- Deploy network detection rules that alert on application servers connecting to RFC1918 ranges or cloud metadata endpoints they do not normally contact.
Monitoring Recommendations
- Forward ZKEACMS access logs and host network telemetry to a centralized SIEM for correlation.
- Establish a baseline of legitimate outbound destinations from the CMS server and alert on deviations.
- Monitor authentication logs for low-privilege accounts accessing Event Action administrative endpoints.
How to Mitigate CVE-2025-10764
Immediate Actions Required
- Restrict access to the ZKEACMS administrative interface and the Event Action System to trusted users and networks only.
- Place the ZKEACMS server behind an egress filter that blocks outbound connections to internal ranges and cloud metadata endpoints.
- Audit existing accounts and revoke unnecessary privileges that grant access to PendingTaskController actions.
Patch Information
No vendor patch has been published. According to the CVE record, the vendor was contacted but did not respond to the disclosure. Track the ZKEACMS project for future security updates and review the VulDB advisory for status changes.
Workarounds
- Implement a strict URL allow-list at a reverse proxy or web application firewall to block requests where the Data parameter contains internal or metadata addresses.
- Configure the host firewall to deny outbound traffic from the ZKEACMS service account except to required external services.
- Disable the Event Action System component if it is not in use within your deployment.
# Example egress restriction using iptables to block metadata and RFC1918 destinations
iptables -A OUTPUT -m owner --uid-owner zkeacms -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zkeacms -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zkeacms -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zkeacms -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
