An attacker can manipulate the img parameter in the image save endpoint of itwanger paicoding to trigger the application to make arbitrary outbound requests. This server‑side request forgery can expose internal resources, potentially exfiltrate data, or allow the attacker to interact with protected services. The weakness corresponds to CWE‑918, a request‑to‑server hijack that grants unauthorized network access.

The vulnerability exists in itwanger paicoding versions 1.0.0 through 1.0.3. The affected code resides in the ImageRestController within the paicoding‑web component. Users running any of these releases on a production or exposed environment are susceptible unless the endpoint is insulated by network controls.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at this time, though the vulnerability is publicly documented and could be leveraged opportunistically. The patch status is unknown, but because the attack vector is remote and the exploit is available, the risk warrants prompt action. No entry in CISA's KEV catalog is yet present, which indicates it is not a widely used exploit yet, yet the potential for internal compromise remains.