stoatchat before 0
stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.
CVSS Score
8.6
HIGH
Published
16 Jul 2026 13:16
Modified
16 Jul 2026 14:16
Source
CIRCL
CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
Network
Complexity
Low
Privileges
None
Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Weaknesses (CWE)
CWE-918
Affected Systems
No vendor data available.
External Links
KEV Status
Not in CISA KEV catalog