The vulnerability resides in the Lucy XSS filter used by Naver. When the ObjectSecurityListener or EmbedSecurityListener option is enabled, an attacker can craft an HTML payload that includes embed or object tags with a src attribute that lacks a file extension. This triggers the filter to perform a server‑side HEAD request to an arbitrary URL, exposing the server to SSRF attacks. The impact includes potential data exposure from internal services or time‑delay based reconnaissance, but does not provide direct code execution or privilege escalation on the host.

The affected product is Naver’s Lucy XSS filter. All versions prior to commit 7c1de6d are vulnerable. No specific version numbers are provided in the advisory. The vulnerability is tied to the ObjectSecurityListener and EmbedSecurityListener options, which are part of the filter’s configuration.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is less than 1%, suggesting low probability of exploit at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted web request that includes embed or object tags without a file extension, which the filter processes and turns into an outbound HEAD request. No additional deployment or privileged access prerequisites are noted in the advisory, so an attacker with the ability to deliver such payloads could exploit the flaw.