CVE-2025-25302

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-253036.9The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTranslator browser extensi CVE-2025-253046.9Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version CVE-2025-253057.0Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potentia CVE-2025-253069.3Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between CVE-2025-25317.8Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers t CVE-2025-25327.8Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a CVE-2025-253235.5An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user informati CVE-2025-253245.5An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a c CVE-2025-253255.5An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via CVE-2025-253265.5An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user in CVE-2025-253295.5An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user informati CVE-2025-25337.5IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a sp