Event Schedule, a web platform for event management, contains a Server Side Request Forgery vulnerability in its import feature. The isUrlSafe() guard, intended to block unsafe URLs, can be bypassed by using bracketed IPv6 literals combined with a resolver that silently fails, and by supplying a pure IPv4 address that still passes the check. When the import process later retrieves the URL, internal or localhost services are contacted over the network via the application’s HTTP client, exposing internal resources or data to an external attacker. The impact is the potential for an attacker to reach any service reachable from the server, which could lead to data exfiltration, privilege escalation, or further lateral movement within the internal network.

The vulnerability affects the open‑source Event Schedule platform, specifically versions 1.0.0 and earlier. The affected vendor is eventschedule, product eventschedule, and the affected versions are 1.0.0 or older.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the web-based import functionality, where a user supplies a crafted URL that the application will fetch without proper validation. An attacker only needs to supply such a URL and trigger the import to cause the internal request to execute. The lack of a patch or workaround means the risk remains until a corrective fix is released or mitigated by configuration changes.