The vulnerability allows an attacker to obtain unauthorised user information by inserting an image with a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the attacker’s server. The attacker can capture the source IP address, User-Agent header, date and time of access, and other request metadata, thereby compromising the user’s privacy. This is a classic information disclosure flaw classified as CWE-200.

The affected product is the Forocoches comments editor, part of the Forocoches platform. No specific version information was provided in the advisory.

The CVSS score of 8.2 indicates a high severity risk, and the advisory reports no EPSS data and no presence in the CISA KEV catalog. Attackers can exploit this flaw by crafting a comment that contains an image tag pointing to a malicious URL. When any user opens the thread, the victim’s browser will make an external request that the attacker can observe, which is a remote exploitation vector that requires the victim to view the comment. Because the flaw relies on passive data leak from an external request, the opportunity to compromise privacy is high for users who read the content.