CVE-2024-25294
Critical · CVSS 9.1REBUILD — Server-Side Request Forgery (SSRF)
- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-918
Description
An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters.
Search profile — drives PoC discovery
Symbols FileDownloader.javaproxyDownloadURL
Keywords CVE-2024-25294REBUILD SSRFREBUILD v3.5FileDownloaderproxyDownloadgetrebuildSSRF RCE REBUILD
Versions: v3.5
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0fkie-cad/nvd-json-data-feeds needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z