The flaw exists in cskefu versions up to 8.0.1 in the MediaController.java component, where an attacker can manipulate the url parameter to force the server to issue requests to arbitrary locations, enabling potential internal network reconnaissance or exploitation. The vulnerability is a Server‑Side Request Forgery (CWE‑918) that may allow an attacker to access sensitive resources, exfiltrate data, or misconfigure services, impacting confidentiality, integrity, or availability of systems that the application connects to.

The affected product is cskefu, specifically any deployment of the cskefu platform up to and including version 8.0.1. No other product variants or higher versions are listed as vulnerable.

The CVSS v3.1 score is 5.3, indicating a moderate risk, and the EPSS score is less than 1 %, suggesting a very low but non‑zero likelihood of exploitation. The vulnerability can be triggered remotely without authentication, and no official patch has yet been released by the vendor, though the exploitation code is publicly available. The security event is not listed in the CISA KEV catalog, so it is currently considered a lower priority relative to known exploited vulnerabilities.