MediaFlow Proxy contains a server‑side request forgery vulnerability in the /proxy endpoint. The application fails to validate or whitelist the destination supplied via the d query parameter. The likely attack vector is a crafted HTTP request to the /proxy endpoint that instructs the server to fetch an arbitrary internal URL, including loopback and cloud‑metadata addresses, and then return the full response. This flaw enables a remote attacker to read sensitive internal data through the proxy’s outward traffic.

Affected systems are installations of MediaFlow Proxy up to and including version 2.4.9. The vulnerability exists in the proxy.py route definitions, where the d parameter is not subject to strict validation. All users running v2.4.9 or earlier are potentially exposed; newer releases beyond 2.4.9 are not impacted according to the available information.

The CVSS score of 8.8 classifies the flaw as High severity. No EPSS score is published, so the exploitation probability is uncertain, but the lack of authentication and unrestricted outbound connectivity make the attack vector feasible. The vulnerability is not currently listed in CISA’s KEV catalog. Because the flaw permits reading of internal services, an attacker could exfiltrate data, perform reconnaissance of the internal network, or use the proxy to pivot to other assets. The combination of high impact and straightforward trigger suggests that this vulnerability poses a significant risk to systems exposed to the internet.