A flaw in the Browser Screenshot Service of Appwrite allows an attacker to manipulate the url argument passed to the PublicHostname function. This manipulation causes the server to issue HTTP requests on behalf of the attacker, exposing internal network resources or enabling access to arbitrary external sites. The vulnerability results in a classic server‑side request forgery, which can lead to data exfiltration or further exploitation of internal services. The weakness is identified as CWE‑918 and carries a CVSS score of 6.9 indicating a medium severity impact.

All released versions of Appwrite up to and including 2.3.0 are affected. The issue resides in the src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php file of the Browser Screenshot Service component. Users should verify their installed version and consider an upgrade if one of these releases is in use.

The CVSS score of 6.9 highlights that exploitation can have a moderate operational risk, especially if internal services are reachable. The EPSS score for this vulnerability is not available, so the current probability of exploitation in the wild cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but the remote attacker can invoke the SSRF through an unauthenticated API call as described in the advisory, indicating that the attack vector is purely remote and does not require special privileges beyond those granted to the screenshot service endpoint.