An attacker can submit malicious JSON data to an anonymous form submission endpoint that is stored verbatim. When a staff member with view permissions pulls a submission’s files, the application performs an HTTP GET to the stored URL without validating host or IP ranges. This enables a second‑order blind SSRF, allowing attackers to force the server to contact internal services, cloud metadata, loopback, or link‑local addresses. The response is only bundled into a ZIP for internal staff, so the attacker does not see the response directly but can infer whether a request occurred or extract indirect information, constituting a confidentiality risk without direct data disclosure.

The vulnerability exists in Endatix self‑hosted platform versions earlier than 0.7.0. The affected product is Endatix itself; any installation using a public, enabled form that accepts anonymous submissions is susceptible.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in KEV, suggesting limited widespread exploitation, yet the need for a staff member to view the submission raises the attack complexity. The indirect nature of the data exfiltration and the requirement for an internal user action mean exploitation is achievable but not trivial. Attacks are likely to be attempted by threat actors with internal network access or by those who can lure an internal user into interacting with the data.