Prior to version 1.1 of Garlic‑Hub, authenticated users can misuse the uploadFromUrl endpoint to trigger HTTP requests from the server to arbitrary internal URLs. This Server‑Side Request Forgery (CWE‑918) allows attackers to enumerate internal services, map the network, and retrieve HTTP responses that are then stored in the publicly accessible media pool, effectively leaking internal information and potentially sensitive data.

The vulnerability affects Garlic‑Hub software from garlic‑signage. All installations running versions earlier than 1.1 are susceptible. No specific sub‑version numbers are listed, so any build prior to 1.1 should be considered impacted.

The CVSS score of 7.7 indicates a high impact vulnerability. No EPSS data is available, but the absence of a KEV listing suggests no publicly known exploits have been catalogued. Attackers require authentication to the Garlic‑Hub interface; once authenticated, they can manipulate the uploadFromUrl parameter to target any internal service, thus gaining internal reconnaissance capability and data exposure.