CVE-2025-3254 is a medium severity (CVSS 6.3) server-side request forgery in xujiangfei admintwo 1.0. The description argument of /resource/add can make the server request addresses it should not. The record names no fix, so restrict access, block internal destinations, and check the project for updates.
What's affected
admintwo version 1.0 by xujiangfei, per the CVE record. The affected function is described as unknown, and the file is /resource/add. The manipulated argument is description.
The vector requires low privileges, network access and low complexity, with low impact on confidentiality, integrity and availability. The record says the exploit has been disclosed publicly and may be used. It does not claim exploitation in the wild, and it is not on CISA KEV.
The record gives no fixed version and lists a public write-up as its main technical reference. Check the project repository for a patch or a newer release.
How to check if you're exposed
If you run admintwo, confirm the version in your deployment files or the project's release tag. Version 1.0 is the one named.
Review the code behind the /resource/add route to see whether the description value is used to fetch a URL, and whether any destination checks exist.
Check access logs for requests to /resource/add, and look at what addresses your server connected to afterwards, using egress logs if you have them.
What to do now
- Restrict access to the application to authenticated, trusted users, and take it off the public internet if possible.
- Block outbound requests from the host to internal ranges and cloud metadata addresses at the network level.
- If you maintain the code, validate fetched URLs against an allow list and resolve hostnames before connecting.
- Watch the project repository for a fix, and apply it when it appears.
- Consider replacing a small unmaintained admin template with a supported product.
Why it matters
The class is CWE-918 (Server-Side Request Forgery). The server fetches a location named by input. Because the server sits inside your network, it can reach things the caller cannot, such as internal admin pages and metadata services.
The scores for SSRF are often modest by themselves, yet they matter on cloud hosts, where the metadata service can hand out credentials to anything that can reach it. Blocking that path at the network layer is worth doing for every server.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Why is a low impact SSRF worth fixing?
What the server can reach from inside your network, such as metadata services or internal tools, may be far more sensitive than what the vector rates for the application itself.
Sources
Last reviewed: 18 October 2026.
