The SSRF vulnerability in Tencent WeKnora’s Import document via URL feature allows an attacker to send the backend through an HTTP redirect chain to internal addresses. The backend correctly rejects private IPs, loopback, reserved hostnames, and cloud metadata endpoints, but it does not validate the final redirect target, letting the server reach internal services such as Docker host addresses. This flaw enables an attacker to obtain unauthorized access to resources that are normally isolated from external traffic.

Tencent WeKnora versions earlier than 0.2.12 are impacted by this redirect‑based SSRF flaw. The vulnerability resides in the document import functionality exposed by the application.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The issue is not listed in the CISA KEV catalog, implying no confirmed public exploits. An attacker must be able to submit a crafted URL to the import endpoint; if successful, the server will follow the redirect chain and attempt to reach internal addresses, potentially exposing internal services.