The notifier function in HomeBox allows authenticated users to provide any URL that the application will POST to, without validating the host, IP address, or port. Although it does not return the target’s response body, the user interface behaves differently depending on whether the request succeeds or times out, creating a side‑channel that can be used to discover services and open ports on machines within the same internal network. This flaw does not grant direct code execution or data exfiltration, but it gives an attacker the ability to map the internal topology of a HomeBox deployment.

HomeBox from sysadminsmedia, versions prior to 0.24.0-rc.1, are affected. The vulnerability appears only for users who have authenticated access to the application and can configure the notifier feature.

The CVSS score of 5.0 indicates moderate severity, and the EPSS value of less than 1% suggests a low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog, meaning no publicly known exploits have been reported. Exploitation requires an attacker to log in to a HomeBox instance and craft specific URLs for the notifier; the effect relies on observing UI changes to infer the status of remote endpoints. While the attack surface is limited to authenticated users, the potential impact of revealing sensitive internal network structure warrants prompt remediation.