Server-Side Request Forgery (SSRF) is present in the PDF export feature of Wegow. An authenticated promoter account can alter the <svg> parameter in the POST request that triggers a Highcharts export service. The export service forwards the request to an arbitrary external URL and embeds the response into the generated PDF. This allows an attacker to cause the system to initiate HTTP requests to attacker‑controlled resources, potentially exposing internal data, interacting with internal services, or facilitating other attacks. The vulnerability is classified as CWE‑918, indicating the exploitation of a server‑side request handling weakness.

Wegow Technologies’ Wegow product is affected. The specific version information is not explicitly listed; the vulnerability applies to the current (actual_version) release of the software.

The CVSS score of 7.1 indicates a high severity risk. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known widespread exploitation yet. Because the attacker must be an authenticated promoter, the attack vector is internal, but once authenticated the attacker can use the export service as a proxy to reach arbitrary external or internal resources. The potential impact ranges from information disclosure to the facilitation of further lateral movement within the network.