An SSRF flaw exists when uploading assets via the URL-based asset upload endpoint. A user holding asset upload permission can instruct the Squidex server to fetch any target URL, including internal or local addresses, and save the response as an asset. This can lead to the server making arbitrary outbound HTTP requests, potentially exposing internal network resources and leaking sensitive data, though the flaw does not provide direct code execution or command execution capabilities.

Squidex Squidex – the open‑source headless content management system. Versions older than 7.23.0 are affected when the asset upload feature is enabled for a user. The vulnerability requires the user to have permission to upload assets.

The CVSS score of 7.3 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires a legitimate user account with asset upload capability; the attacker can trigger outbound requests to arbitrary URLs, including internal services. While the flaw cannot directly grant code execution, it enables the server to access private networks and persist external data, posing significant security risk.