The vulnerability resides in the get_img_from_url function of TiBillet Lespass APIv1. By manipulating the img_url or image_url parameter, an attacker can cause the server to send HTTP requests to any external URL. This SSRF flaw is a classic case of CWE‑918. The consequence is that the attacker can explore internal network services, exfiltrate data, or perform further attacks from the compromised host. No code execution or direct privilege escalation is conveyed by the flaw, but the impact is limited to the server’s outbound network reachability.

All instances of TiBillet Lespass using the APIv1 component before the code commit 10e87909c5d526dffa6d424c104fc12860740537 are affected. The issue is located in the file ApiBillet/serializers.py and targets the three serializers that expose the get_img_from_url functionality.

The CVSS score of 2.1 denotes a low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack can be launched remotely, requires high complexity, and the vendor notes that exploitation is difficult. Nonetheless, it presents an internal network exposure risk until the endpoint is removed in a future major release or migrated to the v2 API, where destination IP validation, redirect checks, timeout, and size limits are implemented.