Description
Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs
Affected products
lichess: lila
References2
- hackerone.com/reports/3165242 ExploitIssue Tracking
- github.com/lichess-org/lila/commit/11b4c0fb00f0ffd8232346f83962… Broken Link
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - EPSS — exploit probability
- 0% percentile: 28 · as of 11 November 2026
- CWE
- CWE-918
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.