Firefly III’s webhook URL validator contains an early‑return that allows any resolved address in the 127.0.0.0/8 block to pass validation. An authenticated user with webhook capability enabled, which is disabled by default, can therefore set up a webhook that targets services on the server’s loopback interface. Because the validator accepts the hostname during validation but the outbound request is made later, the attacker is able to reach internal loopback resources. No user‑visible response is returned from the webhook call, limiting immediate disclosure but still allowing internal network exploration.

The affected product is Firefly III, as identified by the CNA firefly‑iii. No specific affected version numbers are listed. Users of any version where the webhook feature is available and enabled may be impacted.

The CVSS score for this flaw is 4.3, indicating moderate potential impact. The EPSS score is less than 1%, showing a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need to be authenticated to configure a webhook, but once the webhook is set up, they can direct requests to internal addresses, including loopback resources. The blind nature limits immediate disclosure of data, but the ability to reach internal services could facilitate further exploitation.