Technical impact
The vulnerability in Apache Fesod (Incubating) is a Server‑Side Request Forgery (SSRF) that allows an attacker to supply a malicious image URL to the UrlImageConverter component, leading the server to make outbound requests to internal or otherwise restricted resources. This can result in unintended data exfiltration or further lateral movement by the attacker. The weakness is catalogued as CWE‑918.
Affected Systems
The affected product is Apache Fesod (Incubating) produced by the Apache Software Foundation. All releases prior to version 2.0.2‑incubating are vulnerable. Users of earlier releases should verify their installed version against the provided references and plan an upgrade.
Risk and Exploitability
The CVSS score of 5.3 places this SSRF in the moderate‑severity range, while the EPSS score of less than 1 % indicates a low but nonzero exploitation probability. The flaw requires an attacker to supply a crafted image URL to the UrlImageConverter component, typically via an interface that processes image requests. When exploited, the server can fetch internal or restricted resources, which may reveal confidential data or provide a foothold for further attacks. Because any environment that permits outbound traffic to internal networks is at risk, the vulnerability remains significant for systems lacking proper segmentation or restrictive outbound controls. It is not listed in the CISA KEV catalog.
Github GHSA