This vulnerability allows an attacker to induce the wallabag application to make arbitrary outbound HTTP requests during PDF export. By submitting a crafted title or content field that includes an external URL, the exported PDF will resolve the URL on the server side, potentially exposing internal resources or exfiltrating data. The weakness is a classic SSRF flaw as categorized by CWE-918, giving the attacker a path to request any HTTP(S) resource that the server can reach.

The affected product is wallabag, specifically versions from 2.0 through 2.6.14 inclusive. Users deployed these releases should verify their version and plan for an update.

The CVSS score of 6.4 indicates a moderate severity. No exploit probability data is available from EPSS, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that wide‑scale exploitation has not yet been observed. Based on the description, the likely attack vector is via the PDF export functionality which processes user‑supplied content. An attacker with access to submit content or trigger a PDF export can exploit the SSRF path to reach arbitrary internal or external servers. Because the flaw involves outbound requests made by the application, it may be used for internal reconnaissance or to bypass network segmentation.