The vulnerability arises from the file_get_contents function in the URL Handler, which accepts user‑supplied URLs without proper validation. An attacker can send crafted requests that cause the application to fetch arbitrary URLs, enabling Server‑Side Request Forgery. This remote flaw can expose internal network services, exfiltrate sensitive data, or serve as a foothold for more advanced attacks. The impact is moderate, with potential confidentiality and integrity risks depending on the target resources.

SourceCodester:Website Link Extractor version 1.0 is affected. This product is provided by SourceCodester under the name Website Link Extractor.

The CVSS base score is 5.3, indicating a moderate risk. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely, without authentication, by supplying a malicious URL to the vulnerable file_get_contents call. No special infrastructure or credentials are required beyond the ability to submit a URL to the application.