Firefly III’s webhook URL validator allows any resolved IP within the 127.0.0.0/8 block, and skips validation for these addresses. An authenticated user who has webhooks enabled can therefore configure a webhook that reaches services on the host’s loopback interface. Because the validator resolves the target once at validation time, but the outbound request re‑resolves the hostname during sending, a DNS‑rebinding attacker can validate a public IP and have the request ultimately reach a private or internal address. The response body of the webhook call is logged server‑side only, so no content is returned to the user, making this a blind SSRF primitive.

The affected product is Firefly III, as identified by the CNA firefly-iii. No specific affected version numbers are listed. Users of any version where the webhook feature is available and enabled may be impacted.

The CVSS score for this flaw is 4.3, indicating moderate potential impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need to be authenticated to configure a webhook, but once a webhook is set up, the attacker can direct requests to internal addresses, including loopback resources. The blind nature limits immediate disclosure of data, but the ability to reach internal services could facilitate further exploitation.