Admidio’s fetch_metadata.php contains an incomplete SSRF fix that validates the resolved IP address but still passes the original hostname‑based URL to curl_init(). This leaves a DNS rebinding TOCTOU window that can redirect requests to internal IP addresses, allowing an attacker to reach internal network services that should not be exposed. The flaw enables a standard SSRF attack, potentially exposing internal resources or sensitive data dependent on the internal service exposed.

The vulnerability affects Admidio versions prior to 5.0.9. Any installation running Admidio 5.0.8 or earlier is affected. Upgrading to version 5.0.9 or later resolves the issue.

The CVSS score is 6.8, signifying a medium severity. Exploit probability data (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is most likely remote if the web application is reachable from an external network, with the attacker using the fetch_metadata endpoint to cause requests to internal IPs. Attack success requires the target to have internal services exposed that the attacker can interact with one‑way. The impact is disclosure or limited interaction with internal resources rather than full control of the host.