The vulnerability in Matomo 5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. While the software vendor disputes the relevance of this disclosure, arguing that the site administrator, a trusted party, would not set main_url to a URL that exposes additional information to an adversary, the issue still represents a potential data leak. The flaw corresponds to a Server‑Side Request Forgery, implying that crafted HTTP requests can be forwarded by the application to internal resources that should otherwise be inaccessible, leading to unauthorized data exposure without authentication.

Systems affected are installations of Matomo Analytics Server version 5.11.2. The issue exists in the combination of the SiteContentDetector plugin and the SitesManager component. Users running this version on a public‑facing web server are at risk, while those using newer releases are not affected.

The CVSS score of 5 indicates moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the potential for exposing internal resources justifies remediation. The likely attack vector is a remote HTTP request to the Matomo web interface that triggers the SSRF.