A flaw in the SMTP Host Handler within FlowCI flow-core-x disables normal validation when saving SMTP host configuration. As a result, an attacker can craft a request that forces the application to reach arbitrary internal or external URLs, achieving server‑side request forgery (SSRF). This attack allows a remote adversary to probe internal network services, exfiltrate data, or potentially access privileged resources that otherwise would be unreachable from the public network.

The vulnerability exists in FlowCI flow-core-x versions up to and including 1.23.01. No specific sub‑versions are listed, so all builds of the component prior to 1.23.01 are potentially affected.

The CVSSv3 base score is 5.3, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and an exploit has been publicly released, meaning that remote attackers can perform the SSRF without additional prerequisites. Attackers must be able to reach the application over the network to trigger the vulnerable save operation.