CVE-2025-9868 HIGH

CVE-2025-9868: Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin

Vendor Sonatype

Product Nexus Repository

Weakness CWE-918 · SSRF

Published October 8, 2025

Last update October 8, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

Key dates

02Disclosure timeline

October 8, 2025 CVE published

October 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-9868 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html

Related vulnerabilities

04Related CVE

CVE-2024-1568 Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck CVE-2024-37942 WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability CVE-2026-35461 Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL CVE-2024-0304 Youke365 collect.php server-side request forgery CVE-2024-42467 CometVisu Backend for openHAB affected by SSRF/XSS