CVE-2025-60319: Perfree Perfreeblog

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).

Affected products

• Perfree Perfreeblog: version 4.0.11 only

Published 2025-10-30. Last modified 2026-06-17.