The vulnerability allows authorized users with Library upload permissions to exploit a server‑side request forgery in the upload‑by‑URL feature. Because the requests originate from the CMS server, an attacker can reach internal or external resources, scan network infrastructure, access cloud metadata endpoints, or read sensitive data from unprotected services. The potential impact includes exfiltration of internal data, compromise of services with missing authentication, and broader reconnaissance of the environment.

Xibo CMS versions prior to 4.4.1 are affected. The product is the Xibo open‑source digital signage content management system distributed by xibosignage.

The CVSS score of 7.7 signals a moderate to high severity, and with no EPSS data available the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers would need authenticated CMS access with Library upload rights; the SSRF vector is internal to the CMS, making it relatively easy to exploit once access is obtained.