A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API. An attacker can leverage this to enumerate open ports based on response discrepancies and interact with internal services.
CVE-2025-60279
CVSS base score
9.6 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-918
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N