An attacker who can send a crafted HTTP request to the Frigate server’s /ffprobe endpoint can cause the server to fetch any arbitrary URL. The request is made without URL validation, allowing the attacker to force the server to contact internal network hosts, cloud instance metadata services, or perform port scans. This vulnerability (CWE‑918) can lead to information disclosure and potential escalation to other internal resources, but it does not directly provide code execution. The primary impact is the compromise of confidentiality and availability of internal resources accessed by the server.

The vulnerability affects the Frigate network video recorder (NVR) developed by blakeblackshear. All releases prior to version 0.16.3 are vulnerable. Versions 0.16.3 and later contain a patch that validates URLs before processing.

The CVSS base score of 5.0 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers need to be able to reach the Frigate server to send the /ffprobe request; this typically means a local network attacker or a publicly exposed Frigate instance. While the vulnerability does not grant arbitrary code execution, the ability to reach internal services can be leveraged for lateral movement or data exfiltration if other controls are weak.