A weakness in welovemedia FFmate up to version 2.0.15 allows an attacker to invoke the fireWebhook function in /internal/service/webhook/webhook.go with a specially crafted URL. This results in a server‑side request forgery (CWE‑918) that forces FFmate to send HTTP requests to arbitrary destinations, potentially exposing internal services, leaking sensitive data, or enabling further credential‑based attacks. The flaw can be triggered remotely and an exploit program has been publicly released, making it readily usable to an attacker with minimal effort.

The vulnerability affects all installations of welovemedia FFmate running up to and including version 2.0.15. No later releases are listed as impacted; thus any newer version is presumed to be unaffected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not yet listed in the CISA KEV catalog, but because the exploit is publicly available and can be launched over the network, the risk to organizations that have not yet patched or mitigated remains significant. The likely attack vector is an unauthenticated request to FFmate’s webhook endpoint with a URL pointing to an internal or otherwise protected resource. Without a vendor response, mitigation must rely on administrative controls until a patch is released.