A flaw exists in PageKit versions up to 1.0.18 where the url argument supplied to /index.php/admin/system/update/download can be manipulated to trigger arbitrary server‑side HTTP requests. The weakness, classified as CWE‑918, allows an attacker to force the vulnerable host to fetch data from any target address, including internal network resources, potentially exposing sensitive information or enabling further exploitation. The vulnerability is exploitable remotely and public code for the exploit is available, indicating that an adversary could use it without additional discovery steps.

The affected product is PageKit. Versions 1.0.18 and earlier are vulnerable; newer releases are not affected. The vendor is PageKit.

The CVSS score of 5.1 rates this as medium risk. The EPSS score of less than 1% indicates a low probability of widespread exploitation detected in the wild. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote, through HTTP requests directed to the vulnerable download endpoint.