crawlseo before 0.2.4 contains a server‑side request forgery flaw in its crawler engine where the isPrivateIp() check fails to block reserved address ranges and does not pin the address for outbound resolution, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can register a malicious domain that resolves to internal addresses, trigger a crawl to that domain, and obtain metadata such as page title, description, headings, status code and links through the crawl results API, enabling reconnaissance of internal or cloud services.

The vulnerability affects the crawlseo product prior to version 0.2.4. The affected application is the crawlseo crawler engine running on any deployment of the crawlseo software with a version older than 0.2.4. The service assumes that authentication is required to add domains, so only authenticated users are able to exploit this flaw.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is authenticated and relies on a TOCTOU DNS rebinding attack, operator knowledge of the crawler’s internal interfaces is required. If these conditions are met, an attacker can discover internal hosts and services, potentially escalating to further compromise depends on network segmentation and host defenses.