The getDownloadFilePath method in wvp‑GB28181‑pro accepts a MediaServer.streamIp parameter that is not validated, enabling an attacker to craft URLs that force the server to initiate outbound HTTP requests. Key detail from the CVE description: "The manipulation of the argument MediaServer.streamIp results in server‑side request forgery." This can allow an attacker to reach internal network resources or retrieve sensitive data, representing a Server‑Side Request Forgery (SSRF) weakness categorized as CWE‑918. The impact is remote but can expose internal systems if the application can reach them.

Affected vendor product 648540858:wvp‑GB28181‑pro, all releases up to and including version 2.7.4‑20260107 as noted in the CVE description. No information is available for later releases.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is reported as less than 1%, implying a low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog (source: CVE scoring data). The description states that the exploit can be launched remotely, and it is publicly available (source: reference links). Because the flaw is an SSRF that can target arbitrary hosts, environments where the application has outbound connectivity to internal resources face higher risk. However, due to the low EPSS, the immediate threat level is moderate.