GeekAI versions up to 4.2.4 contain a flaw in the Download function of api/handler/net_handler.go that permits manipulation of the url argument. An attacker can supply a crafted URL to cause the server to initiate a request to an arbitrary endpoint, a classic server‑side request forgery scenario. The affected endpoint is accessible from the public API, which makes remote exploitation possible. Published exploits suggest that an attacker can read internal or sensitive resources, exfiltrate data, or facilitate further attacks inside the network. The description does not specify whether elevated privileges are required; the vulnerability can be exploited remotely.

This vulnerability impacts all deployments of GeekAI that are running version 4.2.4 or earlier. No particular minor update or module is singled out, so any installation of the platform before the final patched release is potentially affected.

The CVSS base score of 5.3 reflects a medium severity level, while the EPSS score, currently below 1 %, indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely trigger the flaw by sending a crafted HTTP request to the Download endpoint with a malicious url parameter; no elevated privileges are described, and the description suggests the attack can originate from a publicly reachable endpoint. If exploited, the server could reach internal hosts, sensitive files, or perform cross‑network actions that could lead to data theft or compromise of internal infrastructure.