Prompts.chat before commit 1464475 contains a blind server‑side request forgery flaw in the media‑generator API. Authenticated users can send POST requests to /api/media-generate with a crafted inputImageUrl, causing the server to fetch arbitrary internal URLs. The request result is not returned to the caller; however, the upstream Wiro service can forward data out of the network, providing an indirect exfiltration channel. The vulnerability is identified as CWE‑918.

All releases of Prompts.chat prior to commit 1464475 are affected. No specific version numbers are listed in the CNA data. The product is the Prompts.chat web application hosted by the f:prompts.chat vendor.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is below 1%, suggesting low current exploitation prevalence. The vulnerability is not listed in CISA’s known exploited vulnerability catalog. Exploitation requires authenticated access and sending a crafted POST request; it allows probing of internal services and potential data exfiltration through the Wiro service, but no direct payload is returned to the attacker. Given these facts, patching is advised to eliminate the blind SSRF channel.