Apache Allura's webhook functionality is vulnerable to Server‑Side Request Forgery, allowing an attacker to force the server to resolve and reach arbitrary URLs. This flaw is identified as CWE‑918. An attacker could use the injected URLs to probe internal network resources, exfiltrate sensitive data, or launch further attacks from the gateway. The impact is confidentiality and availability compromise when the server performs unintended outbound requests.

The SSRF vulnerability applies to Apache Allura releases through version 1.20.0, inclusive. Users running these versions are at risk and should update to the patched 1.21.0 release.

The EPSS score of <1% indicates a very low probability of exploitation, but the high CVSS score of 9.1 and the classification as a Server‑Side Request Forgery still warrant prompt patching. Based on the description, the likely attack vector is the public webhook endpoint, and an adversary can trigger the vulnerable request from outside the network. Once the server resolves the injected URL, it may contact internal IPs or services, enabling data exfiltration or privilege escalation. No active exploitation reports are available and the vulnerability is not listed in CISA's KEV catalog, which suggests that it has not yet been exploited in the wild. Nevertheless, the broad attack surface and potential impact on confidentiality and availability warrant patching.