CVE-2025-64716 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
When using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to javascript: URLs, it could still trigger dangerous behavior in some cases.
GET https://example.com/.within.website/?redir=javascript:alert() responds with Location: javascript:alert().
Anybody with a subrequest authentication seems affected. Using javascript: URLs will probably be blocked by most modern browsers, but using custom protocols for third-party applications might still trigger dangerous operations.
This was originally reported by @mbiesiad against Weblate.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.