CVE-2025-62612 Overview
CVE-2025-62612 is a Server-Side Request Forgery (SSRF) vulnerability in FastGPT, an open-source AI Agent building platform maintained by Labring. The flaw resides in the workflow file reading node, which fails to security-verify network links before fetching remote resources. Attackers can supply crafted URLs that cause the FastGPT backend to issue arbitrary outbound requests. The vulnerability affects all FastGPT releases prior to 4.11.1, and the maintainers have addressed it in version 4.11.1. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can abuse the workflow file reading node to make the FastGPT server request internal or restricted network endpoints, enabling reconnaissance of internal services and cloud metadata endpoints.
Affected Products
- FastGPT versions prior to 4.11.1
- FastGPT workflow file reading node component
- Self-hosted FastGPT deployments exposing workflow execution
Discovery Timeline
- 2025-10-22 - CVE-2025-62612 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62612
Vulnerability Analysis
FastGPT provides a workflow engine that lets users chain nodes together to build AI agents. One node type reads files by URL, retrieving content for downstream processing by language models. The file reading node accepts a network link parameter but does not validate the target address against an allowlist or block private, loopback, and link-local ranges. As a result, the FastGPT backend performs the HTTP request on behalf of the caller and returns the response into workflow context. Attackers can point the node at internal services, cloud provider metadata endpoints such as 169.254.169.254, or other non-public infrastructure reachable from the server. The workflow response channel then leaks portions of the internal response back to the attacker.
Root Cause
The root cause is missing URL validation in the workflow file reading node. The code path fetches the user-supplied link without checking the resolved host, scheme, or port. There is no DNS rebinding protection and no denylist for RFC 1918, loopback, or metadata IP ranges.
Attack Vector
Exploitation requires network access to a workflow execution surface that includes the vulnerable node. An attacker crafts a workflow, or influences an existing one, so the file reading node targets an internal URL. The FastGPT server then issues the request server-side, bypassing perimeter controls. See the FastGPT GHSA-573g-3567-8phg advisory for maintainer commentary.
No verified proof-of-concept code is published. The vulnerability mechanism is described in prose based on the maintainer advisory rather than a reconstructed exploit.
Detection Methods for CVE-2025-62612
Indicators of Compromise
- Outbound HTTP requests from the FastGPT backend to RFC 1918 addresses, 127.0.0.0/8, or 169.254.169.254.
- Workflow definitions containing file reading nodes with URLs pointing to internal hostnames or raw private IPs.
- Unexpected access patterns in internal service logs originating from the FastGPT server IP.
Detection Strategies
- Inspect FastGPT application logs for workflow file reading node executions and record the target URL for each invocation.
- Correlate egress firewall or proxy logs with the FastGPT server address to identify requests to non-public destinations.
- Audit stored workflow JSON definitions for suspicious file node URLs referencing metadata services or internal subnets.
Monitoring Recommendations
- Enable egress logging on the host running FastGPT and alert on connections to link-local or metadata IP ranges.
- Monitor cloud provider instance metadata service (IMDS) access counters for anomalous request volume from the FastGPT workload.
- Track FastGPT version inventory and flag any instance running a release below 4.11.1.
How to Mitigate CVE-2025-62612
Immediate Actions Required
- Upgrade FastGPT to version 4.11.1 or later on all self-hosted deployments.
- Restrict outbound network access from the FastGPT server to only the destinations required for LLM API calls and legitimate document sources.
- Enforce IMDSv2 with hop-limit 1 on cloud instances hosting FastGPT to blunt metadata exfiltration.
Patch Information
The maintainers released the fix in FastGPT 4.11.1. Refer to the FastGPT Security Advisory GHSA-573g-3567-8phg for upgrade guidance and commit references.
Workarounds
- Place the FastGPT backend behind an egress proxy that blocks private, loopback, and link-local address ranges.
- Disable or remove the file reading node from available workflow node types until upgrading is possible.
- Apply network policies or security groups that deny traffic from the FastGPT workload to internal management interfaces and metadata endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
