The vulnerability allows an authenticated user to supply arbitrary URLs via the mets_uri or iiif_uri parameters of POST /api/documents/{pk}/imports/. Because the IMPORT_ALLOWED_DOMAINS setting defaults to '*', the application forwards the request to any host without address filtering, redirect limiting, or timeout enforcement. An attacker can thus cause the server to reach internal or external resources, including cloud instance metadata services, potentially exposing sensitive configuration data or credentials. The flaw is a classic Server‑Side Request Forgery (CWE‑918).

Affected versions are Scripta eScriptorium releases up to and including 26.04.1. The fix is available in 26.04.2, 1.0.1, and 0.13.9 respectively.

With a base CVSS score of 8.5, the vulnerability is considered High. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. An attacker requires only authenticated access to the API; once authenticated, they can exploit the flaw by crafting import requests. The risk is that internal services or metadata endpoints can be accessed, leading to potential information disclosure or further lateral movement.