The vulnerability is a Server‑Side Request Forgery (SSRF) where an attacker can specify a local or internal URL in the Media Manager’s remote fetch field. The vulnerability allows the server to retrieve arbitrary data from internal or local resources, potentially exposing internal host information or serving as a foothold for additional attacks. This flaw is identified as CWE‑918 and can lead to unauthorized access to internal services and data leaks.

The affected product is the e107 content management system from e107inc. All versions prior to 2.3.4 are vulnerable; the fix is implemented in 2.3.4 and later releases.

The CVSS score of 4.3 reflects a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web‑based administrator interface, requiring an authenticated admin session to submit the remote URL. Once exploited, the attacker can retrieve internal resources via the server, potentially compromising confidentiality and availability of internal services.