SGLang exposes a server‑side request forgery and local file read flaw in its multimodal generation endpoint /v1/chat/completions. An attacker can supply an arbitrary image_url parameter; because the service does not sanitize or validate the URL, the backend will fetch the resource and return its contents. This allows the attacker to reach internal network services, retrieve metadata, sensitive files, or shared secrets exposed by the host.

The vulnerability exists in the SGLang multimodal generation service, located on the /v1/chat/completions endpoint. No specific product releases are listed as fixed, so all releases that implement this endpoint are potentially impacted until a patch is released by the maintainer.

The EPSS score is below 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 reflects a moderate severity. An attacker can send a crafted HTTP request to the public /v1/chat/completions endpoint with a malicious image_url parameter, enabling server‑side request forgery and local file read that allows access to internal metadata, secrets, and services, potentially compromising confidentiality and integrity of internal resources.