The HAPI FHIR Validator HTTP service contains a blind Server‑Side Request Forgery flaw in the /loadIG endpoint that accepts a user supplied URL without validating the hostname, scheme, or domain. Because the endpoint is unauthenticated, an attacker who can reach the validator can supply arbitrary internal URLs. The response leaks hidden error information and, when the explore parameter remains true, the code triggers multiple outbound calls, amplifying the amount of information returned.

HAPI FHIR, the open‑source HL7 FHIR implementation in Java, is affected. All releases prior to version 6.9.4 of the org.hl7.fhir.core component are vulnerable. The flaw is present in the FHIR Validator HTTP service that includes the /loadIG endpoint.

The CVSS v3 score of 5.8 indicates medium severity. EPSS data is not available, and it is not listed in the CISA KEV catalog, but the flaw is exploitable over the network by any unauthenticated user with access to the validator service. Because the vulnerability requires only network connectivity and a crafted JSON request, an attacker can map internal services, probe cloud metadata endpoints, or discover hostnames through error‑based information leakage. The lack of authentication, combined with the server‑initiated outbound requests, makes this a valuable reconnaissance vector for attackers building an internal foothold.