The flaw lies in mosparo's automatic rule package source URL feature. When a project member with an editor role stores a URL, the server later fetches it without blocking private or loopback destinations and follows HTTP/HTTPS redirects. This turns the feature into a stored SSRF primitive that can be used for internal HTTP probing. Classified as CWE-918, this vulnerability does not grant direct code execution but allows an attacker to identify and enumerate internal services, potentially leaking sensitive information and facilitating subsequent attacks.

Any mosparo installation prior to version 1.4.13 is impacted. The vulnerability was fixed in release 1.4.13; all earlier versions, regardless of sub‑release, maintain the weakness.

The CVSS score of 5 indicates moderate severity. EPSS data is not available and the flaw is not listed in CISA KEV, suggesting limited public exploitation to date. However, exploitation requires an authenticated user with editor privileges; based on the description, it is inferred that an attacker may obtain such privileges through phishing or credential compromise. Once authenticated, the attacker can instruct the server to query arbitrary internal endpoints, turning mosparo into an internal discovery tool. The ability to follow redirects and lack of outbound restrictions make the SSRF easy to exploit if the conditions are met.