CouchCMS 2.2.1 contains a server‑side request forgery flaw that can be triggered by an authenticated user uploading a malicious SVG file through the browse.php endpoint. The upload process accepts external entity references embedded in the SVG, allowing the attacker to forge arbitrary HTTP requests to internal services and resources. This can lead to data disclosure, resource manipulation, or other unintended interactions within the network. The weakness is classified as CWE‑918.

CouchCMS is affected by this vulnerability in a range of released versions. The product includes versions 1.3.5, 1.4.5, 1.4.7, 1.4, 2.0, 2.1, 2.2.1, 2.2, and 2.3, as indicated by the known CPE list. Administrators should verify the exact version running on their site and compare it against this list.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, suggesting a low to moderate exploitation probability. The flaw is not listed in the CISA KEV catalog, indicating no publicly known active exploits at this time. Because the vulnerability requires authenticated access to the file upload functionality, the attack surface is limited to users with upload privileges, but internal network exposure remains a concern.