A server‑side request forgery flaw in Gophish’s import API allows authenticated users with low privileges to instruct the application to fetch arbitrary URLs, including loopback and private addresses that are normally blocked by the dialer’s deny list. By supplying internal host URLs, attackers can read the responses returned by those services and observe error messages, thereby discovering the presence and port usage of internal hosts. The vulnerability is based on CWE‑918, which describes an authorization bypass through trusting user‑supplied URLs, and the exposed data includes service responses that can reveal sensitive internal information. The impact is limited to the confidentiality of internal network resources and does not directly affect external systems or the public Internet.

All Gophish installations running version 0.11.0 through 0.12.1 are affected. The SSRF flaw exists in the /api/import/site API controller and the dialer module that performs outbound HTTP requests.

The CVSS score of 5.3 indicates a medium severity, reflecting the precondition of authentication and the lack of privileged escalation. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no current evidence of active exploitation. Based on the description, it is inferred that any authenticated user can exploit the flaw to enumerate internal services, and this can enable reconnaissance or lateral movement in environments where the Gophish instance is exposed to broader networks.