An OT CMS admin endpoint, /admin/read.php, processes the AnnounContent field by fetching the URL supplied in the request body without requiring authentication. The server subsequently returns the response of that external request to the attacker. This allows a remote attacker to instruct the application to retrieve any resource accessible from the server, including internal network services or any external website, potentially leaking sensitive data or facilitating further attacks.

OTCMS installations running version 7.66 or earlier are impacted. The flaw resides exclusively in the handling of the AnnounContent field on the admin read page; no other product variants are mentioned.

The CVSS and EPSS scores are not available, and the vulnerability is not listed in the CISA KEV catalog. However, because the endpoint accepts arbitrary URLs without authentication and can reach internal or external hosts, exploitation is straightforward for an external attacker. The risk remains high for any system that exposes the vulnerable endpoint to the internet or to untrusted users, and malicious requests could be used to enumerate internal resources or perform further attacks.