The vulnerability is a server‑side request forgery that allows a remote attacker to cause the fish‑island‑backend service to fetch arbitrary URLs supplied in the url parameter of a GET request to /api/web/parse. By following redirects through OkHttp, the attacker can reach internal hosts, loopback interfaces, or cloud metadata endpoints, and the backend returns parsed page titles, meta descriptions, and favicons. This flaw is classified as CWE‑918 and can lead to information disclosure of internal network details and potentially further exploitation.

The affected product is lhccong’s fish‑island‑backend. Any deployment that includes the commit 7c61b78 is vulnerable; versions prior to this commit and those that have not yet applied patches for the SSRF vulnerability are at risk.

The CVSS score of 6.9 places the vulnerability in the medium severity range, and the EPSS score is not available, indicating that no widespread exploitation data exists yet. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely and without authentication by sending a crafted GET request, making the backend reach internal or sensitive endpoints and exfiltrate parsed page data.