In Campfire versions 1.4.4 and earlier, the server’s link‑unfurl logic does not fully block requests to special IPv4/IPv6 private ranges. An attacker who can post a message can supply a URL that resolves to CGNAT, NAT64, or 6to4 addresses, causing the server to fetch the target and expose any returned OpenGraph metadata. The vulnerability does not allow alteration of data or denial of service; it is limited to disclosure of metadata that internal endpoints may or may not provide.

Basecamp Once Campfire 1.4.4 and all earlier releases are vulnerable. The issue was fixed in release 1.4.5; any deployment running that version or earlier is affected.

The CVSS score of 3.1 indicates low severity, and the publicly available EPSS score is absent. The vulnerability is not listed in the CISA KEV catalog. An authenticated user can trigger the flaw by posting a crafted link; the attack requires knowledge of the special‑use IP ranges listed in the description. Because the potential impact is limited to metadata and most endpoints return none, the overall risk is low but should be mitigated promptly by applying the vendor patch.