Mercator’s configuration panel, accessed via /admin/config/parameters, contains a Server‑Side Request Forgery vulnerability that allows an authenticated user with the configure permission to supply arbitrary URLs to curl_init(). Because the input string is passed verbatim, users can bypass the intended /api/dbInfo suffix by appending a # fragment, giving them full control over the target address. The lack of scheme, hostname, or private IP filtering means that schemes such as telnet:// can be used for internal port scanning, and gopher:// can access unauthenticated internal services such as Redis or Memcached, which under certain deployment conditions can lead to remote code execution.

Sourcentis Mercator versions older than 2025.05.19 are vulnerable. All deployed instances prior to the 2025.05.19 release, regardless of environment, are affected.

The CVSS score of 5.3 categorizes the vulnerability as moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires a logged‑in user with the configure role, so the attack vector is limited to authenticated users; however, once authenticated, the attacker can request arbitrary external resources, perform internal network reconnaissance, and potentially execute code on internal services via gopher://. The lack of external access restrictions and the ability to target internal infrastructure increase the risk to confidentiality, integrity, and availability of the internal network.