A Server‑Side Request Forgery flaw exists in the custom process creation feature of linqi. An authenticated user can craft a process that includes an HTTP Request component, causing the server to send arbitrary HTTP requests to any target. By interpreting the server’s responses—Success, Failed, or 504 Gateway Time‑out—the attacker can deduce whether specific internal ports are open or closed, enabling detailed network reconnaissance.

The vulnerability affects linqi GmbH’s linqi product. No specific version information was supplied in the advisory, so all releases may be susceptible until an official fix is released.

The CVSS score of 5.3 indicates moderate risk. The exploit is feasible only to users with valid authentication, but the SSRF capability allows probing across the internal network, which can aid further attacks. No EPSS data is provided, and the issue is not listed in CISA KEV, suggesting it is not currently exploited at scale. Nonetheless, the ability for authenticated users to enumerate internal services represents a significant threat vector for adversaries with access to the application.