The LocalAI platform contains an unauthenticated server‑side request forgery flaw that is triggered by sending a POST request to the /models/apply endpoint with an unsanitized gallery URL field. The server forwards that URL to the gallery.GetGalleryConfigFromURLWithContext function without validation, causing it to private or loopback ranges. Error messages return a fragment of the response body, allowing attackers to retrieve internal data and exploit confidential information, as described by CWE‑918.

The vulnerability is present in all installations of LocalAI that have not applied the fix introduced in commit f9 or later. No explicit version range is listed, so any deployment that has the unpatched code is considered vulnerable.

With a CVSS score of 9.2 the issue is classified as critical, while the EPSS score of less than 1% indicates a low but non‑zero exploitation probability. The endpoint is publicly reachable without authentication, increasing the attack surface. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit it simply by sending a crafted POST to /models/apply with a gallery URL pointing to an internal or loopback service; the server issues the request and leaks part of the response, enabling information disclosure.