A flaw in the client.get function of src/mcp-server.js in huimeicloud hm_editor up to version 2.2.3 allows an attacker to manipulate the url parameter sent to the image‑to‑base64 endpoint, causing the server to perform arbitrary HTTP requests. This server‑side request forgery can be triggered remotely and may expose internal resources or allow data exfiltration. The CWE is 918, highlighting the vulnerability in how the server processes untrusted URL input.

The vulnerability affects the huimeicloud hm_editor component, specifically all releases up to and including version 2.2.3. Operations consuming the image‑to‑base64 endpoint in any affected deployment are potentially exploitable until a patch or configuration change is applied.

With a CVSS score of 6.9 the flaw is classified as moderate severity; the exploit is publicly disclosed and may be used by attackers. Exploitation requires only a crafted request to the vulnerable endpoint, making it straightforward for a remote attacker. Due to the absence of an EPSS score and its non‑listing in the KEV catalog, precise exploit likelihood is uncertain, but remote SSRF remains a significant risk to confidentiality and integrity of internal services.