A public proxy endpoint within the Kitodo.Presentation extension permits a user to supply any URL to be fetched by the server. For one specific HTTP method the authorization guard is omitted, so the request target is fully controlled by the caller. The server performs the outbound request and returns only the status code and selected response headers to the attacker, enabling probing of internal hosts and ports while revealing no response body. This is a CWE‑918 Server‑Side Request Forgery flaw that amounts to a moderate‑severity information‑disclosure vulnerability that can be used to discover network services and serve as a foothold for further compromise.

TYPO3 websites that have installed the Kitodo.Presentation extension are vulnerable. The weakness exists regardless of TYPO3 version, provided the vulnerable extension remains deployed.

The CVSS score of 6.9 indicates medium severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the current environment. The vulnerability is not cataloged in CISA KEV. Compromise is straightforward: an unauthenticated attacker can send arbitrary HTTP requests, receive status codes and headers, and thus enumerate internal resources. No direct remote code execution or privilege escalation is possible, but the information gained can facilitate more advanced attacks such as pivoting or credential theft if combined with other weaknesses.