The html_to_markdown module accepted arbitrary HTTP(S) URLs without validating the scheme or the target address, enabling a server‑side request forgery (SSRF) that could reach loopback, private, or link‑local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing these requests to man‑in‑the‑middle attacks. Together, an attacker who can supply input to these modules may cause the MISP server to fetch internal resources or capture tampered responses, compromising confidentiality and integrity.

All MISP module releases before 3.0.7 are affected, including the html_to_markdown and qrcode modules. The vulnerability is specific to the MISP:misp-modules package and its expansion modules.

The CVSS score of 5.8 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the KEV catalog. Exploitation would require an attacker able to supply URLs to the vulnerable modules, which is typically possible through unauthenticated or privileged access to MISP event inputs or module configuration. The likely attack vector is a remote attacker controlling the module input. Once exploited, the attacker may access internal network resources or tamper with external images received by the server.