OneUptime accepts webhook target URLs through a validation routine that filters out private and loopback IPv4 addresses, as well as a subset of IPv6 addresses. However, the routine does not handle IPv4‑mapped IPv6 literals such as [::ffff:127.0.0.1]. Because these literals are treated as address literals rather than hostnames, the SSRF protection path that normally blocks private ranges is bypassed. The HTTP client connects to the embedded IPv4 address, enabling an attacker who can configure a webhook to direct the server to local or internal services, read their responses, and retrieve the payload through the webhook result page. This flaw therefore permits confidentiality and availability compromise via SSRF, without necessarily enabling code execution on the host.

Affected vendors: OneUptime. Product: OneUptime server. Versioning: All releases prior to 12.0.7 lack the necessary check for the IPv4‑mapped IPv6 range; starting with 12.0.7 the safeguard is applied and the issue is resolved.

The CVSS score of 7.1 classifies the vulnerability as ‘High’ severity. No EPSS value is available, so the exploitation probability cannot be quantified, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated project member with permission to create or edit webhooks; no privilege escalation is needed beyond that. Once the bitmap is exploited, an attacker can access local services, metadata endpoints, or the loopback interface of the OneUptime server, potentially exfiltrating sensitive data or performing further internal reconnaissance.