The vulnerability in the UrlImageConverter component of Apache Fesod (Incubating) allows an attacker to bypass built‑in SSRF protection by using DNS rebinding. An application that accepts user‑supplied image URLs for spreadsheet creation performs a two‑step IP verification: it resolves the hostname to an IP, then later opens a connection that resolves the hostname again. If the attacker controls the DNS resolution of the hostname, they can cause the second resolution to point to a private or otherwise restricted IP address after the first check has passed. This enables the attacker to send requests to internal services, potentially exposing sensitive data or allowing further lateral movement within the network. The weakness is classified as CWE‑918, indicating a deliberate exploitation of an SSRF defense mechanism.

This issue affects Apache Fesod (Incubating) versions up to and including 2.0.2‑incubating. The current CVE describes a DNS rebinding bypass of the protection that existed in 2.0.2‑incubating. Apache Fesod (Incubating) 2.1.0‑incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit allowlist of trusted hostnames before the feature can be enabled.

Because the EPSS score for this CVE is 0.00407, the estimated likelihood of exploitation is low but non‑zero, below 1%. Nonetheless, the SSRF nature of the flaw means any environment that enables remote image fetching for user‑supplied URLs could be susceptible to internal network access by an attacker who controls DNS responses. The attack requires the attacker to supply a malicious URL in a spreadsheet that the application processes; once the URL is accepted, the attacker can direct the application to contact arbitrary internal endpoints. The CVSS score of 9.1 indicates a high severity. No public exploitation has been reported, but the potential for data compromise or lateral movement remains, especially in uncontrolled or poorly isolated deployments.