CVE-2025-63551: MetInfo · XML External Entity (XXE)
Affects MetInfoSource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubsh4ll0t/MetInfopkg:github/sh4ll0t/MetInfoOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Immediate mitigation should include disabling XML external entity processing in the MetInfo CMS XML parser configuration if possible, to prevent XXE attacks.
- Implement strict input validation and sanitization on all XML inputs, especially those processed by the /admin/#/webset/?head_tab_active=0 endpoint, to reject malicious XML entities.
- Employ network-level controls such as egress filtering and internal firewall rules to restrict the server's ability to make arbitrary outbound HTTP requests, limiting SSRF impact.
- Monitor server logs and network traffic for unusual outbound requests originating from the CMS server, which may indicate exploitation attempts.
- If patches become available, prioritize their timely application.
- Conduct internal network segmentation to minimize sensitive resource exposure to compromised web servers.
- Use Web Application Firewalls (WAFs) with rules designed to detect and block SSRF and XXE attack patterns targeting XML inputs.
- Educate development and security teams about secure XML parsing practices and SSRF risks to prevent similar vulnerabilities in future deployments.
Description
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.