The flaw lies in the URI.create call inside S3ClientFactory.java of ContiNew Admin’s Storage Management Module, allowing manipulation of the target URI. This can cause the application to perform arbitrary outbound HTTP requests to any address supplied by an attacker. The effect can range from accessing internal services to exfiltrating data; however, the exact extent depends on the environment and is inferred from the nature of the vulnerability.

ContiNew Admin versions up to and including 4.2.0 are affected. Users of 4.2.0 or earlier who have not applied a workaround are at risk. No other vendors or product versions are listed as impacted.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score signals a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector—inferred from the description—is remote, with an attacker sending crafted requests to the storage‑management endpoint that trigger the SSRF behavior. Successful exploitation would allow the server to reach arbitrary URLs, potentially enabling further attacks.