A flaw exists in the media.controller.ts file of the devlikeapro WAHA API Request Handler that allows an attacker to manipulate incoming requests so the server sends HTTP requests to arbitrary URLs. This server‑side request forgery (SSRF) can expose internal resources, enable credential theft, or facilitate further exploitation. The vulnerability is listed as CWE‑918 and is noted to be exploitable from a remote location.

The affected product is devlikeapro WAHA, for all releases up to and including version 2026.3.4. No other versions are mentioned, and the vendor has not provided a detailed list of affected builds.

The CVSS score of 5.3 indicates moderate overall risk. The EPSS score is listed as less than 1 %, suggesting a very low probability of real‑world exploitation at the time of this analysis, and the vulnerability is not yet listed in the CISA KEV catalog. However, an exploit has been published and can be triggered remotely, making the risk higher than the low EPSS alone might imply. Without an official vendor patch, the vulnerability remains open for exploitation until a fix is deployed or mitigations are applied.