imgproxy vulnerabilities and fixes

Q: How do I fix imgproxy vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is imgproxy being exploited right now?

None of the tracked imgproxy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which imgproxy CVE should I patch first?

CVE-2023-30019 currently ranks highest (49/100): imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the ima.

Recent CVEs affecting imgproxy, with upgrade or downgrade steps. 2 tracked.

imgproxy has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-05-08. Highest priority: CVE-2023-30019 (score 49/100).

CVE-2023-30019 MEDIUM 5.3 UPGRADE imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the ima
CVE-2023-1496 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.

FAQ

How do I fix imgproxy vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is imgproxy being exploited right now?

None of the tracked imgproxy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which imgproxy CVE should I patch first?

CVE-2023-30019 currently ranks highest (49/100): imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the ima.

← Back to latest CVEs