CVE-2025-14518 is a medium severity server-side request forgery flaw (CVSS 6.3) in PowerJob up to version 5.1.2. The record places it in the checkConnectivity function of PingPongUtils.java and says the exploit is public. The fix is not confirmed in the record, so check the project issue and release notes.
What's affected
The record lists PowerJob up to and including 5.1.2. The weak spot sits in the Network Request Handler component, in the checkConnectivity function of src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java. The arguments targetIp and targetPort are the ones named.
The record does not name a fixed version. Newer PowerJob releases exist, but this record does not tie any of them to this CVE, so read the linked GitHub issue and the project release notes before you rely on an upgrade.
The score is 6.3 (medium). The vector needs a low privilege account, so exposure depends on who can sign in to your PowerJob instance.
How to check if you're exposed
Find out which PowerJob version you run. For a jar deployment, check the file name of the server jar or the version shown in the web console.
find / -name "powerjob-server*.jar" 2>/dev/null
If the version is 5.1.2 or older, you are in the affected range. Then check who can reach the server and its login page, since the vector needs a low privilege account. For Maven projects that embed PowerJob libraries, list the dependency tree.
mvn dependency:tree | grep -i powerjob
What to do now
- Find every PowerJob server you run and note its version.
- Read the linked GitHub issue and the project release notes to see if a fix is available, then upgrade to a release you have confirmed.
- Limit who can reach the PowerJob server, and keep it off the public internet.
- Remove accounts you do not need, since the vector needs a low privilege login.
- Restrict outbound traffic from the server to the hosts it must reach, so a forged request has few places to go.
Why it matters
Server-side request forgery means the server can be talked into making a network request on behalf of someone else. The weakness is CWE-918. Servers often sit in networks that outside users cannot reach, so a forged request can touch internal services, scheduling nodes or metadata endpoints.
In PowerJob, the record points at a connectivity check that takes a target address and port. A tool that tests whether a host answers is useful, and it is also a ready made way to probe a network when the inputs are not restricted. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record says a public exploit exists.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why restrict outbound traffic from a server like this?
If the server can only reach the hosts it needs, a forged request has few useful targets. It limits the damage while you wait for or test a fix.
Does this CVE appear in the CISA KEV list?
No. The record marks it as not in the Known Exploited Vulnerabilities catalog. It does say a public exploit exists, so treat it as a real risk anyway.
Sources
- Safeguard Gold entry for CVE-2025-14518
- github.com reference
- github.com reference
- github.com reference
- vuldb.com reference
This post is based on the CVE record (published 2025-12-11, source cna@vuldb.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
