The vulnerability is located in the sitemap.fetch function of the /sitemap endpoint in Page‑Replica. By controlling the url parameter, an attacker can instruct the server to issue HTTP requests to arbitrary hosts. This permits the attacker to reach internal services, exfiltrate data, or launch secondary attacks. The weakness falls under CWE‑918 and results in a Server‑Side Request Forgery that compromises confidentiality and integrity of internal network resources.

All releases of Page‑Replica up to commit e4a7f52e75093ee318b4d5a9a9db6751050d2ad0 are affected. Because the project follows a rolling‑release model, no specific version numbers are available for a fixed release. Any deployed instance that has not received the latest code changes may still be vulnerable.

The CVSS score of 5.3 reflects moderate severity; the attack is remote and requires access to the vulnerable endpoint but does not grant elevated permissions. No EPSS score is provided and the issue is not listed in the KEV catalog, yet a public exploit exists, suggesting that attackers could exploit it. The risk is therefore moderate to high until a vendor patch or adequate mitigation is applied.