{"id":"CVE-2025-9799","summary":"Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery","details":"A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.","modified":"2026-08-12T03:51:09.993032700Z","published":"2025-09-01T22:02:09.356Z","database_specific":{"cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9799.json","cna_assigner":"VulDB"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9799.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9799"},{"type":"ADVISORY","url":"https://vuldb.com/?id.322114"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.641128"},{"type":"REPORT","url":"https://github.com/langfuse/langfuse/issues/8522"},{"type":"REPORT","url":"https://github.com/langfuse/langfuse/issues/8522#issue-3320549867"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.322114"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/langfuse/langfuse","events":[{"introduced":"1211de3efb1a8811ad587dcecb4722ffd7f77d68"},{"last_affected":"e07120b16361c6a3417addb12a0440a8dd204c64"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:langfuse:langfuse:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.0"},{"last_affected":"3.0"},{"introduced":"3.1"},{"last_affected":"3.1"},{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"3.3"},{"last_affected":"3.3"},{"introduced":"3.4"},{"last_affected":"3.4"},{"introduced":"3.5"},{"last_affected":"3.5"},{"introduced":"3.6"},{"last_affected":"3.6"},{"introduced":"3.7"},{"last_affected":"3.7"},{"introduced":"3.8"},{"last_affected":"3.8"},{"introduced":"3.9"},{"last_affected":"3.9"},{"introduced":"3.10"},{"last_affected":"3.10"},{"introduced":"3.11"},{"last_affected":"3.11"},{"introduced":"3.12"},{"last_affected":"3.12"},{"introduced":"3.13"},{"last_affected":"3.13"},{"introduced":"3.14"},{"last_affected":"3.14"},{"introduced":"3.15"},{"last_affected":"3.15"},{"introduced":"3.16"},{"last_affected":"3.16"},{"introduced":"3.17"},{"last_affected":"3.17"},{"introduced":"3.18"},{"last_affected":"3.18"},{"introduced":"3.19"},{"last_affected":"3.19"},{"introduced":"3.20"},{"last_affected":"3.20"},{"introduced":"3.21"},{"last_affected":"3.21"},{"introduced":"3.22"},{"last_affected":"3.22"},{"introduced":"3.23"},{"last_affected":"3.23"},{"introduced":"3.24"},{"last_affected":"3.24"},{"introduced":"3.25"},{"last_affected":"3.25"},{"introduced":"3.26"},{"last_affected":"3.26"},{"introduced":"3.27"},{"last_affected":"3.27"},{"introduced":"3.28"},{"last_affected":"3.28"},{"introduced":"3.29"},{"last_affected":"3.29"},{"introduced":"3.30"},{"last_affected":"3.30"},{"introduced":"3.31"},{"last_affected":"3.31"},{"introduced":"3.32"},{"last_affected":"3.32"},{"introduced":"3.33"},{"last_affected":"3.33"},{"introduced":"3.34"},{"last_affected":"3.34"},{"introduced":"3.35"},{"last_affected":"3.35"},{"introduced":"3.36"},{"last_affected":"3.36"},{"introduced":"3.37"},{"last_affected":"3.37"},{"introduced":"3.38"},{"last_affected":"3.38"},{"introduced":"3.39"},{"last_affected":"3.39"},{"introduced":"3.40"},{"last_affected":"3.40"},{"introduced":"3.41"},{"last_affected":"3.41"},{"introduced":"3.42"},{"last_affected":"3.42"},{"introduced":"3.43"},{"last_affected":"3.43"},{"introduced":"3.44"},{"last_affected":"3.44"},{"introduced":"3.45"},{"last_affected":"3.45"},{"introduced":"3.46"},{"last_affected":"3.46"},{"introduced":"3.47"},{"last_affected":"3.47"},{"introduced":"3.48"},{"last_affected":"3.48"},{"introduced":"3.49"},{"last_affected":"3.49"},{"introduced":"3.50"},{"last_affected":"3.50"},{"introduced":"3.51"},{"last_affected":"3.51"},{"introduced":"3.52"},{"last_affected":"3.52"},{"introduced":"3.53"},{"last_affected":"3.53"},{"introduced":"3.54"},{"last_affected":"3.54"},{"introduced":"3.55"},{"last_affected":"3.55"},{"introduced":"3.56"},{"last_affected":"3.56"},{"introduced":"3.57"},{"last_affected":"3.57"},{"introduced":"3.58"},{"last_affected":"3.58"},{"introduced":"3.59"},{"last_affected":"3.59"},{"introduced":"3.60"},{"last_affected":"3.60"},{"introduced":"3.61"},{"last_affected":"3.61"},{"introduced":"3.62"},{"last_affected":"3.62"},{"introduced":"3.63"},{"last_affected":"3.63"},{"introduced":"3.64"},{"last_affected":"3.64"},{"introduced":"3.65"},{"last_affected":"3.65"},{"introduced":"3.66"},{"last_affected":"3.66"},{"introduced":"3.67"},{"last_affected":"3.67"},{"introduced":"3.68"},{"last_affected":"3.68"},{"introduced":"3.69"},{"last_affected":"3.69"},{"introduced":"3.70"},{"last_affected":"3.70"},{"introduced":"3.71"},{"last_affected":"3.71"},{"introduced":"3.72"},{"last_affected":"3.72"},{"introduced":"3.73"},{"last_affected":"3.73"},{"introduced":"3.74"},{"last_affected":"3.74"},{"introduced":"3.75"},{"last_affected":"3.75"},{"introduced":"3.76"},{"last_affected":"3.76"},{"introduced":"3.77"},{"last_affected":"3.77"},{"introduced":"3.78"},{"last_affected":"3.78"},{"introduced":"3.79"},{"last_affected":"3.79"},{"introduced":"3.80"},{"last_affected":"3.80"},{"introduced":"3.81"},{"last_affected":"3.81"},{"introduced":"3.82"},{"last_affected":"3.82"},{"introduced":"3.83"},{"last_affected":"3.83"},{"introduced":"3.84"},{"last_affected":"3.84"},{"introduced":"3.85"},{"last_affected":"3.85"},{"introduced":"3.86"},{"last_affected":"3.86"},{"introduced":"3.87"},{"last_affected":"3.87"},{"introduced":"3.88.0"},{"last_affected":"3.88.0"},{"introduced":"0"}]}}],"versions":["3.0","3.1","3.10","3.11","3.12","3.13","3.14","3.15","3.16","3.17","3.18","3.19","3.2","3.20","3.21","3.22","3.23","3.24","3.25","3.26","3.27","3.28","3.29","3.3","3.30","3.31","3.32","3.33","3.34","3.35","3.36","3.37","3.38","3.39","3.4","3.40","3.41","3.42","3.43","3.44","3.45","3.46","3.47","3.48","3.49","3.5","3.50","3.51","3.52","3.53","3.54","3.55","3.56","3.57","3.58","3.59","3.6","3.60","3.61","3.62","3.63","3.64","3.65","3.66","3.67","3.68","3.69","3.7","3.70","3.71","3.72","3.73","3.74","3.75","3.76","3.77","3.78","3.79","3.8","3.80","3.81","3.82","3.83","3.84","3.85","3.86","3.87","3.88.0","3.9","v3.88.0","v3.87.1","v3.87.0","v3.86.1","v3.86.0","v3.85.2","v3.85.1","v3.85.0","v3.84.0","v3.83.0","v3.82.0","v3.81.1","v3.81.0","v3.80.1","v3.80.0","v3.79.1","v3.79.0","v3.78.2","v3.78.1","v3.78.0","v3.77.0","v3.76.0","v3.75.4","v3.75.3","v3.75.2","v3.75.1","v3.75.0","v3.74.0","v3.73.1","v3.73.0","v3.72.1","v3.72.0","v3.71.0","v3.70.0","v3.69.0","v3.68.0","v3.67.0","v3.66.1","v3.66.0","v3.65.3","v3.65.2","v3.65.1","v3.65.0","v3.64.0","v3.63.1","v3.63.0","v3.62.1","v3.62.0","v3.61.0","v3.60.1","v3.60.0","v3.59.1","v3.59.0","v3.58.0","v3.57.2","v3.57.1","v3.57.0","v3.56.0","v3.55.0","v3.54.1","v3.54.0","v3.53.0","v3.52.0","v3.51.2","v3.51.1","v3.51.0","v3.50.0","v3.49.1","v3.49.0","v3.48.1","v3.48.0","v3.47.0","v3.46.0","v3.45.2","v3.45.1","v3.45.0","v3.44.0","v3.43.0","v3.42.1","v3.42.0","v3.41.1","v3.41.0","v3.40.0","v3.39.0","v3.38.0","v3.37.0","v3.36.0","v3.35.1","v3.35.0","v3.34.1","v3.34.0","v3.33.1","v3.33.0","v3.32.1","v3.32.0","v3.31.0","v3.30.0","v3.29.1","v3.29.0","v3.28.3","v3.28.1","v3.28.0","v3.27.2","v3.27.1","v3.27.0","v3.26.0","v3.25.0","v3.24.1","v3.24.0","v3.23.0","v3.22.0","v3.21.0","v3.20.0","v3.19.0","v3.18.0","v3.17.1","v3.17.0","v3.16.0","v3.15.0","v3.14.0","v3.13.0","v3.12.0","v3.11.1","v3.11.0","v3.10.0","v3.9.0","v3.8.0","v3.7.1","v3.7.0","v3.6.2","v3.6.1","v3.6.0","v3.5.3","v3.5.2","v3.5.1","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.1","v3.1.0","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9799.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}