What is CVE-2025-52186?

CVE-2025-52186 is a medium-severity vulnerability in Lichess Lila, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2025-11-13.

How severe is CVE-2025-52186?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SSRF in Lichess Lila

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.003 (23.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.

Affected products

Lichess Lila
N/a — versions n/a

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org (Exploit, Issue Tracking)
cve@mitre.org (Broken Link)

Frequently asked questions

What is CVE-2025-52186?: CVE-2025-52186 is a medium-severity vulnerability in Lichess Lila, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2025-11-13.
How severe is CVE-2025-52186?: Medium severity. CVSS v3 base score is 6.5 out of 10.