The vulnerability resides in the html_to_markdown expansion module of MISP Modules. The module validates URLs through an is_safe_url() function that rejects unsafe destination addresses using a BLOCKED_RANGES list. The list is incomplete, missing critical ranges such as 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. This shortcoming, coupled with the normalisation of IPv4‑mapped IPv6 addresses, allows a server‑side request forgery. An adversary who can create or edit attributes on a MISP instance can supply a URL that resolves to one of these unblocked internal ranges. When the module fetches that URL to convert HTML to Markdown, the request originates from the MISP server, giving the attacker read access to internal services that are otherwise inaccessible from external networks. The primary consequence is confidentiality leakage; the MISP instance itself remains uncompromised but is forced to act as a proxy for internal resources.

The issue affects the MISP Modules repository, specifically the html_to_markdown expansion module. Any installation of MISP that includes this module with the unpatched BLOCKED_RANGES implementation is vulnerable. The vendor lists the affected product as MISP Modules. No specific version range is identified; therefore all code deployments containing the described validation logic are at risk.

The CVSS base score of 6.3 indicates a moderate severity. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. The attack requires an authenticated user with permission to create or modify MISP attributes; thus, privilege escalation is a prerequisite. Once exploited, the attacker can retrieve confidential data from internal services via the server‑side request. The risk is therefore principally the exposure of sensitive internal information, with secondary reputational impact.