CVE-2025-1521
Published: 23 April 2025
Summary
CVE-2025-1521 is a medium-severity SSRF (CWE-918) vulnerability in Posthog Posthog. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 39.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-1521 is a server-side request forgery vulnerability affecting the slack_incoming_webhook parameter handling in PostHog. The flaw stems from insufficient validation of supplied URIs before the application retrieves remote resources, enabling information disclosure on affected installations. It was originally reported as ZDI-CAN-25352 and carries a CVSS 3.1 base score of 6.5.
Authenticated remote attackers can supply a crafted webhook URI to induce the PostHog service account to access arbitrary internal or external resources, resulting in the exposure of sensitive information. The vulnerability requires valid credentials but no user interaction, and the CVSS vector reflects network-accessible exploitation with high confidentiality impact.
A fix was implemented in the PostHog repository via commit 6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42, and the issue is detailed in Zero Day Initiative advisory ZDI-25-096.
The EPSS score rose from a low baseline to a recorded peak of 0.0121, indicating emerging exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12185
Vulnerability details
PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the slack_incoming_webhook parameter.…
more
The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25352.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.