A server‑side request forgery flaw exists in the image function of the Mp Module Media Proxy within RhaPHP. An attacker can supply a malicious URL to the url parameter, causing the application to retrieve the targeted resource. This remote request can exfiltrate internal data or reach internal services that are normally inaccessible from the public network. The flaw is represented by CWE‑918 and can be triggered without authentication, enabling an attacker to compromise confidentiality, integrity, or availability of internal resources.

The affected product is geesondog RhaPHP, specifically the Mp Module Media Proxy component handling image requests. The vulnerability applies to all releases up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Because RhaPHP follows a rolling‑release model, no fixed version identifier is available; any deployment using the affected component is potentially vulnerable until a vendor update is released.

The CVSS score of 6.9 indicates a moderate severity. Explicit EPSS data is not available, and the flaw is not currently listed in CISA’s KEV catalog. The attack vector is remote and relies on the image endpoint being publicly accessible. Since the vendor has not yet issued a fix, the risk remains moderate but could become significant if the flaw is actively exploited. Until a patch is issued, limiting outbound requests or disabling the vulnerable module mitigates the threat.