CVE-2024-25738

Open Library Foundation VuFind versions 2.0 through 9.1 before 9.1.1 are vulnerable to a Server-Side Request Forgery (SSRF) in the /Upgrade/FixConfig route. An attacker can exploit this to overwrite local configuration files, potentially gaining access to the administrator panel and achieving Rem...