Kanboard versions 1.2.52 and earlier allow authenticated users to create web links that contain an IP address expressed in hexadecimal notation. The SSRF filter in app/Core/Http/Client.php incorrectly accepts this non‑dotted notation, and cURL resolves the address to a real internal IP. An attacker can therefore direct the application to any internal address, including cloud metadata services, localhost, or other RFC1918 destinations, potentially exposing sensitive configuration data. The vulnerability does not provide direct code execution but can be leveraged to gather internal information, elevate privileges, or pivot to other services within the network.

Kanboard 1.2.52 and any earlier releases are affected. Users running these versions should update to a supported release that patches the SSRF filter.

The CVSS score of 8.4 classifies the issue as high severity. The EPSS score of < 1% indicates a currently low probability of exploitation, and the lack of a CISA KEV listing suggests it has not yet been widely exploited. The attack requires a legitimate authenticated account and the ability to submit a link creation request; once the application resolves the supplied hexadecimal IP, the attacker can potentially read or manipulate data from any exposed internal service. Given the high impact and potential ease of exploitation for users who have access, the risk to any affected Kanboard installation remains significant.