A Server‑Side Request Forgery flaw in the OTCMS content management system’s /admin/read.php endpoint lets an attacker, without authentication, send arbitrary URLs in the AnnounContent parameter. The server then performs an HTTP request to the specified address, exposing internal services or any remote target to the attacker. This could lead to the leakage of sensitive information, probing of internal network services, or use of the server as a proxy for subsequent attacks.

The vulnerability affects all versions of OTCMS up to and including 7.66. Any installation that allows users to modify the AnnounContent field in the /admin/read.php script is at risk.

With a CVSS score of 7.5 the flaw carries high severity, yet the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The defect is not listed in the CISA KEV catalog. Because it does not require authentication, an external attacker can exploit the SSRF directly; if the attacker already has network access, the risk is amplified, making it a serious threat to confidentiality.