SocialEngine versions 7.8.0 and earlier contain a blind server‑side request forgery in the /core/link/preview endpoint. The uri request parameter is treated as a destination URL without any sanitization, allowing an authenticated remote attacker to cause the server to initiate HTTP requests to arbitrary URLs, including internal or loopback addresses. This flaw is a classic instance of CWE‑918 and permits attackers to enumerate internal network services or access resources that are not intended to be exposed externally.

The affected product is SocialEngine by SocialEngine. All releases up to and including 7.8.0 are vulnerable; versions newer than 7.8.0 are not reported as affected.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Attackers need authenticated access to the application, after which they can supply a crafted uri value to trigger the blind SSRF. Successful exploitation could lead to internal network enumeration and potential access to services that should remain internally reachable.