Vulnerability · Published Jul 21, 2025 · Assigned by GitHub_M

CVE-2025-54122Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint

Critical 10.0

In plain English

A critical-severity server-side request forgery in Manager from Manager-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.9%top 40.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and exfiltration of sensitive data from isolated network segments. This vulnerability is fixed in version 25.7.21.2525.

Affected products (as reported)

Vendor	Product	Versions
Manager-io	Manager	< 25.7.21.2525

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Manager-io/Manager/security/advisories/GHSA-347w-cgwh-m895 x_refsource_CONFIRM