A Server‑Side Request Forgery protection bypass exists in the html_to_markdown module of misp-modules. The module verifies URLs against blocked IP ranges but fails to normalize IPv4‑mapped IPv6 addresses. An authenticated attacker can supply a URL such as http://[::ffff:127.0.0.1]/ or a hostname resolving to an IPv4‑mapped IPv6 address, causing the server to resolve and connect to services on its loopback, internal, or link‑local interfaces. The content retrieved from those services is then converted to Markdown and returned to the attacker, exposing internal web services, administrative interfaces, or cloud instance metadata. This flaw corresponds to the common weakness enumeration CWE-918, reflecting a Server‑Side Request Forgery vulnerability.

All installations of the MISP platform that include the misp-modules html_to_markdown extension are affected, specifically those running a module version before the patch referenced by commit 3bae4108a3ba1e507727d5264697fd7303ba0b89. The vulnerability can be exploited only by authenticated users with permission to invoke the module.

The CVSS base score is 8.3, indicating high severity. The EPSS score is reported as < 1%, suggesting a very low probability of exploitation in observed traffic, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access to the module and the ability to supply a crafted URL. Successful exploitation can lead to read access to internal interfaces, cloud metadata, or enable further lateral attacks. The attack surface is limited to the outbound fetch capability of the module.