The getCodeByLink endpoint in HBAI‑Ltd Toonflow‑app is vulnerable to server‑side request forgery when the Link argument is manipulated. A remote attacker can cause the application to fetch an arbitrary URL and trigger actions on the server, potentially exposing internal network resources or enabling data exfiltration. The vulnerability carries a CVSS score of 5.3, indicating moderate severity. The exploit is publicly known and can be triggered from the internet.

Toonflow‑app from HBAI‑Ltd, versions up to and including 1.1.1, are affected.

The EPSS score of less than 1% suggests a low exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack vector is remote and the endpoint is inherently high‑risk, the potential impact remains significant if an attacker can reach the service. Exploitation requires only the ability to issue an HTTP request to the /getCodeByLink API with a crafted Link parameter; no privileged access is needed.