This vulnerability is a Server Side Request Forgery (SSRF) and arbitrary file read flaw in the core of Google AppSheet. An authenticated remote attacker can craft requests to the production cluster to read sensitive local files and reach internal network resources. As a result, confidential data may be exfiltrated and unintended components of the internal network could be accessed, leading to a breach of confidentiality and integrity.

AppSheet Cloud Web main servers running a release prior to 2025‑11‑23 are susceptible. The vulnerability was patched by Google on the stated date, and the fix applies to all subsequent versions of the AppSheet Web service.

The flaw carries a CVSS score of 8.5, categorizing it as high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access, so it is likely that only users with valid AppSheet credentials can leverage the SSRF or file‑read capabilities. The overall risk is moderate to low, but the exposure of sensitive data remains a concern if login credentials are compromised.