CVE-2025-13872 is a critical severity server-side request forgery flaw (CVSS 9.1) in ObjectPlanet Opinio 7.26 rev12562, affecting the survey import feature. Check with ObjectPlanet that Opinio 7.28, marked an important security update, covers it.
What's affected
The affected component is the survey import feature. The record describes it as server-side request forgery, which means an attacker can make the server send requests on their behalf.
Affected version: 7.26 rev12562. The record names no fixed version. The vendor changelog marks Opinio 7.28 (7 May 2026) as an important security update recommended for all installations but does not cite this CVE, so ask the vendor to confirm.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The weakness classes are CWE-918.
How to check if you're exposed
Identify the instance and its version first, then look at what the server can reach from where it runs.
The record names Opinio 7.26 rev12562. The version is shown in the Opinio administration interface, and the vendor changelog lists the release history.
Server-side request forgery is mostly dangerous because of what sits next to the server. Check which internal addresses and cloud metadata endpoints the application host can reach, and whether egress is filtered.
grep -Ei "169\.254\.169\.254|localhost|127\.0\.0\.1|10\.|192\.168\." /var/log/nginx/access.log | head
That searches your access log for requests whose parameters contain internal addresses. Adapt the log path and the patterns to your environment. A result means a request carried an internal address, not that it succeeded.
What to do now
- Confirm which instances you run and which version they are on.
- Review the Opinio 7.28 release (7 May 2026), which the vendor changelog marks as an important security update recommended for all installations, and ask ObjectPlanet to confirm that it covers this CVE.
- Restrict outbound traffic from the application host so it can only reach the destinations it needs. This is the strongest control against SSRF in general.
- Block access to the cloud instance metadata service from the application, or require the hardened token-based variant your provider offers.
- Review the logs of the affected feature for requests to internal addresses or unusual hosts.
- Restrict who can use the affected feature to trusted users where the product allows it.
Why it matters
Server-side request forgery (CWE-918) turns a feature that fetches a URL into a way to reach places the attacker cannot. The server sits inside your network and is trusted by other systems, so its requests can touch internal services, admin panels and metadata endpoints.
The fix is a combination of input validation and network controls. Allowlisting destinations in the code is best, and egress filtering catches what the code misses. Neither depends on the other, so use both where you can.
Try it yourself
The demo shows an API scan, which is the style of check that surfaces endpoints that fetch URLs on a caller's behalf.
Click through it at your own pace, or open it full screen.
Quick check
What makes SSRF hard to see in logs?
Blind SSRF gives the attacker no response body, so the signs are in your own outbound logs and DNS queries, not in the web response.
Where should I start fixing it?
The record names no fixed version. The vendor changelog marks Opinio 7.28 (7 May 2026) as an important security update recommended for all installations but does not cite this CVE, so ask the vendor to confirm. Whatever the vendor does, filtering outbound traffic from the host is worth doing.
Sources
- Gold vulnerability page for CVE-2025-13872
- CVE record for CVE-2025-13872 as published by its CNA, with a published date of 2025-12-02
- ObjectPlanet Opinio changelog
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
