The vulnerability is a server‑side request forgery in feiyuchuixue’s sz‑boot‑parent, triggered by manipulating the url argument to the /api/admin/common/files/download endpoint. A remote attacker can cause the application to send arbitrary HTTP requests to any target chosen by the attacker. The description notes that the exploit is highly complex and difficult, so the likelihood of successful exploitation in the wild is low. However, a successful SSRF could expose internal services or allow data exfiltration, and it is identified as CWE‑918.

The flaw exists in all releases of sz‑boot‑parent up to and including 1.3.2‑beta. The project has released version 1.3.3‑beta, which implements a protocol whitelist that allows only http and https URLs in the download interface. Users running any earlier version are susceptible.

The CVSS score of 2.3 indicates a low severity rating, and the EPSS score of less than 1% combined with a non‑listed status in the KEV catalog suggests that widespread exploitation is unlikely. Because the attack vector is remote and the exploitation process is complex, the overall risk is moderate. Nonetheless, organizations should still address the issue promptly to eliminate the SSRF surface area.