Read the docs
TI-2025-35701 Aliases CVE-2025-57818

Firecrawl SSRF Vulnerability via malicious webhook

Priority LOW 28CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix Fixed firecrawl (firecrawl): 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
firecrawlfirecrawlbefore 2.0.12.0.1Patch availableCNA
  • firecrawl Vendorfirecrawl Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA

Remediation

  • Fix · CNA firecrawl (firecrawl) Fixed in 2.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-57818

References

Other 4

  • TI-2026-80146 DNS rebinding bypasses SSRF checks in Firecrawl Playwright service CVSS 4.0HIGH 7.0
  • TI-2026-51121 Firecrawl: Arbitrary file read via JSON Schema $ref expansion CVSS 4.0CRITICAL 9.3
  • TI-2026-58731 firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath CVSS 4.0HIGH 8.7
  • TI-2026-25319 Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation CVSS 4.0HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences