The vulnerability in the UrlImageConverter component of Apache Fesod (Incubating) allows an attacker to bypass built‑in SSRF protection by using DNS rebinding. An application that accepts user‑supplied image URLs for spreadsheet creation performs a two‑step IP verification: it resolves the hostname to an IP, then later opens a connection that resolves the hostname again. If the attacker controls the DNS resolution of the hostname, they can cause the second resolution to point to a private or otherwise restricted IP address after the first check has passed. This enables the attacker to send requests to internal services, potentially exposing sensitive data or allowing further lateral movement within the network. The weakness is classified as CWE‑918, indicating a deliberate exploitation of an SSRF defense mechanism.

This issue affects Apache Fesod (Incubating) versions up to and including 2.0.2‑incubating. The previous bug report CVE‑2026‑49328 covers SSRF in earlier releases; the current CVE describes a DNS rebinding bypass of the protection that existed in 2.0.2‑incubating. The fix was implemented in 2.1.0‑incubating, which disables remote URL image fetching by default and requires an explicit allowlist of trusted hostnames before the feature can be enabled.

Because the EPSS score for this CVE is not available and it is not listed in the CISA KEV catalog, the precise likelihood of exploitation is unknown, but the SSRF nature of the flaw means any environment that enables remote image fetching for user‑supplied URLs could be susceptible to internal network access by an attacker who controls DNS responses. The attack requires the attacker to supply a malicious URL in a spreadsheet that the application processes; once the URL is accepted, the attacker can direct the application to contact arbitrary internal endpoints. No public exploitation has been reported to date; this statement is inferred from the absence of known incidents, yet the potential for data compromise or lateral movement exists, especially in uncontrolled or poorly isolated deployments.