The vulnerability in router‑for‑me CLIProxyAPI 6.9.29 allows an attacker to manipulate the "url" argument in the internal API handler to trigger a server‑side request forgery. This flaw can lead to the API server making arbitrary outbound requests to internal or external resources controlled by the attacker, potentially exposing sensitive data or facilitating further attacks. The flaw is categorized as CWE‑918 and the description confirms that remote exploitation is possible.

Router‑for‑me CLIProxyAPI version 6.9.29 is affected. No other product versions are listed in the current data, and the vulnerability is tied specifically to the internal/api/handlers/management/api_tools.go component.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to send crafted input to the API, typically via an exposed endpoint, and does not require additional credentials. Consequently, the risk is present in environments where the API is reachable from untrusted networks, and exploitation could be performed by remote actors.