The vulnerability resides in the ImageTransferStorage function of HotGo version 2.0 or earlier, allowing an attacker to construct requests that force the server to make HTTP requests to arbitrary URLs. The manipulation can be achieved remotely and the exploit code is publicly available. Successful exploitation enables the attacker to read or manipulate data on external services, potentially exfiltrate confidential information or launch further attacks through the server’s outbound connections. The flaw is identified as CWE‑918.

Bufanyun HotGo component Endpoint is affected for all releases up to and including version 2.0. Versions newer than 2.0 have not been reported to contain this issue and are presumed safe.

The CVSS score of 5.3 indicates moderate severity, and the very low EPSS (< 1%) suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack path requires remote access to the vulnerable endpoint, typically exposed on the public network, making the exploit feasible from an external attacker’s perspective. While it does not grant arbitrary code execution, it can allow data exfiltration and manipulative outbound requests.