Technical impact
The identified flaw stems from an admin‑only endpoint that accepts an arbitrary URL to download backup archives. The request is executed through an unprotected HTTP client, allowing an attacker who has, or has compromised, administrator credentials, to direct the server to fetch content from any internal or external address. This enables probing internal services, accessing cloud metadata endpoints, or otherwise performing reconnaissance against the protected environment. The issue is categorized as a server‑side request forgery (CWE‑918) and carries a CVSS score of 7.2, indicating a medium‑to‑high risk of compromise.
Affected Systems
The vulnerability exists in Squidex installations running versions older than 7.23.0. Version 7.23.0 and later include a fix. All Squidex deployments that expose the RestoreController.PostRestoreJob endpoint to administrative users are potentially impacted; the root component is the Squidex Squidex content management platform.
Risk and Exploitability
Because this flaw requires authenticated admin access, the threat level is mitigated by the need for privileged credentials, yet the impact is high if such credentials are compromised. The CVSS score reflects the severity, and the EPSS score of less than 1% indicates a very low but non‑zero exploitation probability; the vulnerability is not listed in the CISA KEV catalog. The recommended attack path involves an authenticated administrator using the backup restore endpoint to supply a malicious URL, resulting in the server attempting a request to a target internal resource. Failure to mitigate may enable sensitive internal disclosure or further lateral movement within the network.
