The vulnerability resides in the isUrlReachable function of the Album Website component, where an attacker can manipulate the Website argument to cause the server to issue outbound HTTP requests to arbitrary URLs. This server-side request forgery enables potential internal network reconnaissance, data exfiltration, or interaction with internal services that should be inaccessible from the public internet. The impact is confined to the integrity and confidentiality of resources the application can reach, and it may also affect availability if the request triggers denial of service conditions.

This flaw affects the smrealms smr Album Website, specifically the AlbumEditProcessor.php endpoint. Because the product follows a rolling release model, precise version numbers are not disclosed; however, the issue has been fixed in the commit cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. All installations running the vulnerable code should apply this patch or upgrade to the latest release that incorporates the fix.

The CVSS rating of 5.3 indicates a medium severity risk, and the EPSS score is not available, suggesting no publicly observed exploitation probability yet. The vulnerability is not listed in the CISA KEV catalog, but it has already been publicly disclosed and could be exploited by attackers who can control the Website parameter. Given the remote nature of the exploit and the lack of protective controls in the affected function, the risk remains tangible for organisations that rely on the unpatched application.