CVE-2025-64252 is a medium-severity SSRF vulnerability in Marco Milesi ANAC XML Viewer (<= 1.8.2). It allows an attacker with low privileges to cause the server to perform unauthorized requests, potentially exposing or altering data. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact. No official patch or vendor advisory is currently available, and no known exploitation in the wild has been reported.

The SSRF vulnerability can lead to limited confidentiality and integrity impacts by enabling an attacker to make the server send crafted requests to internal or external systems. This could expose sensitive information or modify data accessible to the server. There is no reported impact on availability. The attack requires network access and low privileges but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor for vendor updates. Until a fix is released, consider restricting network access from the affected application to sensitive internal resources as a temporary mitigation.