A server‑side request forgery flaw in Pinry allows an unauthenticated remote attacker to supply any URL to the pin‑from‑URL feature, which forwards that URL directly to Python’s requests.get() without validation. The result is the Pinry server making HTTP requests to any host the attacker chooses, potentially exposing internal services or cloud metadata endpoints. This can lead to data exposure, internal network reconnaissance, and in some contexts to privilege escalation within the application’s environment.

The vulnerability exists in all Pinry installations up to and including version 2.1.13. Users of Pinry must verify the version in use and apply the available update.

With a CVSS score of 7.5 the issue is considered high severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, but the attack surface is broad: anonymous users can trigger requests from the server with no authentication required. The default configuration that allows new registrations further widens the exploitable user base. An attacker can simply provide a crafted URL to reach internal or external hosts, potentially bypassing network controls that rely on the server not making unsolicited outbound connections.