This issue represents CWE-918, a server‑side request forgery, and also stems from CWE-20, improper input validation. The html_to_markdown expansion module in MISP Modules validates URLs with an is_safe_url() function that rejects unsafe destination addresses using a BLOCKED_RANGES list. The list was incomplete, missing several critical IP ranges such as 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. This shortcoming creates a server‑side request forgery flaw that allows an authenticated user who can create or edit attributes to supply URLs pointing to these internal addresses. When the module fetches the URL to convert HTML to Markdown, the request originates from the MISP server, permitting the attacker to probe and read responses from otherwise unreachable internal services, carrier‑grade NAT infrastructure, or link‑local endpoints. The principal consequence is confidentiality exposure; the MISP instance itself is not compromised, but it is coerced into acting as a proxy for internal resources.

The vulnerability affects MISP Modules, particularly its html_to_markdown expansion module. All installations of this module that include the incomplete BLOCKED_RANGES list are at risk. No specific version range is listed, so any deployed code using the module with the described validation logic is vulnerable.

The CVSS score of 6.3 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack would require an authenticated user with permission to create or modify attributes; therefore, privilege level is a prerequisite. Once the flaw is exploited, the attacker can retrieve data from internal services, but cannot directly compromise the MISP server. The risk is primarily reputational and confidentiality if sensitive internal data is exposed via the proxy.