The getUrlInfo function in the Bookmark Metadata Endpoint of fr0tt benotes is vulnerable to manipulation of the url parameter, allowing a server-side request forgery (SSRF). An attacker can supply a crafted URL that the server will subsequently request, potentially enabling access to internal network resources or exfiltration of sensitive data. The vulnerability is remotely exploitable, and public disclosures indicate that the exploit is known and can be used against vulnerable installations.

fr0tt benotes versions up to and including 2.8.1 are affected. Any installation running 2.8.1 or earlier may be exposed; later versions are presumed fixed but should be verified.

The CVSS score of 5.3 indicates a medium severity vulnerability. With no EPSS score available and no listing in CISA KEV, the likelihood of widespread exploitation is uncertain, yet the remote nature of the SSRF means any exposed instance could be abused if configuration or network controls are lax. The lack of a vendor patch means the risk remains until an update is applied or mitigated.