The function post_data.get in the AstrBot API endpoint enables an attacker to craft requests that the server will forward to any target within or outside the network. This can lead to unauthorized access to internal services, data exfiltration, or further compromise of internal resources. The vulnerability is a classic SSRF flaw, categorized under CWE‑918, and allows the attacker to influence outbound traffic initiated by the server.

AstrBotDevs AstrBot versions up to and including 4.22.1 are affected. Users running any release within this range are vulnerable and should review their deployment for the presence of the impacted API endpoint.

The CVSS score of 5.3 indicates a medium severity vulnerability. Publicly available proof‑of‑concept code exists, and the flaw can be exercised remotely via the API, implying a non‑trivial exploitation potential. EPSS data is not provided, and the vulnerability is not catalogued in the KEV list. The likely attack vector involves sending crafted payloads to the vulnerable endpoint from an exposed network or malicious actor controlling API traffic.