The Librarian contains an internal port scanning flaw built into its web_fetch utility. The flaw allows an attacker to issue GET requests that the application forwards to arbitrary internal IP addresses and ports. This server‑side request forgery can be leveraged to probe the internal network, revealing services and configurations deployed in the Hertzner cloud infrastructure that the application relies on. Such reconnaissance can expose critical services that might later be targeted for credential theft or further attacks.

All versions of TheLibrarian.io that include the vulnerable web_fetch tool are affected. The vendor has fixed the issue in all affected releases.

The CVSS score of 7.5 conveys a high severity, yet the EPSS score of less than 1% indicates a low expected exploitation probability in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs to invoke the web_fetch endpoint with crafted parameters; no additional privileges are required. Exploitation grants internal network visibility but does not provide direct code execution or data exfiltration capabilities.