The vulnerability lies in Dozzle’s SSRF guard, which fails to block IPv4 addresses embedded within 6to4, NAT64, Teredo, and IPv4‑compatible IPv6 addresses. An authenticated user can submit a webhook notification URL that resolves to a loopback or link‑local target, allowing the service to reach internal resources that should otherwise be inaccessible. This constitutes a Server‑Side Request Forgery (CWE‑918) that could expose private network services, but does not provide remote code execution or privilege escalation.

The issue affects Dozzle from version 10.5.2 up through 10.6.15. The fix is included in release v10.6.15. The product is developed by amir20, and any deployments running an affected version are susceptible until upgraded.

The CVSS score of 2.3 reflects a low severity, and the EPSS < 1 % suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated user who can configure webhook URLs; the user can then trick Dozzle into resolving an IPv6 transition address that maps to an internal IP such as 127.0.0.1 or a link‑local address, enabling access to local services. Because the reachability is limited to internal hosts, the impact is localized.