The vulnerability resides in the uploadRemoteFile function within the Remote Upload API. A malformed or crafted argument for the url parameter allows an attacker to instruct the application server to make arbitrary HTTP requests. This SSRF capability can expose internal services, read sensitive data, or pivot to other systems, thereby compromising confidentiality and integrity. The description does not indicate denial‑of‑service impacts.

BidingCC BuildingAI versions up to and including 26.0.1 are affected. The flaw is located in the file-storage.service.ts module under packages/core/src/modules/upload/services. No newer versions are documented as safe.

The CVSS base score is 6.9, reflecting moderate to high risk. The EPSS score of <1% suggests a low probability of current exploitation, and the issue is not in the CISA KEV catalog. The exploitation is remote and does not require local access; an attacker only needs to cause the application to request an arbitrary URL. No official patch or workaround has been released yet.