The vulnerability permits a blind server‑side request forgery against internal network services; the attacker supplies an initial URL to the /download endpoint, which is validated, but the embedded Chromium browser follows redirects to internal addresses after validation. The result is an internal request without the attacker seeing the response. The affected component is the validateDownloadURL() function. This flaw allows an attacker to cause the server host to reach services that are otherwise isolated, potentially revealing sensitive data or enabling lateral movement, though the effect is limited because the feature is controlled by the security.allowDownload flag, which is disabled by default.

PinchTab, released by the vendor PinchTab, is impacted. Versions 0.8.2 and earlier contain the issue; the problem was resolved in release 0.8.3. Only systems running the vulnerable releases with the security.allowDownload setting enabled are at risk.

The CVSS base score is 5.8, indicating moderate severity. The EPSS score is below 1 %, and it is not listed in the CISA KEV catalog, signaling low likelihood of exploitation in the wild. However, because the attacker can force the browser to hit internal‑only endpoints through redirects, the risk is real for environments that enable the download feature. Exploitability requires that an attacker can serve a crafted page that triggers the download endpoint, which may be possible if the server exposes that endpoint to untrusted users or if the attacker can influence a user inside the network.