LLaMA‑Factory contains a server‑side request forgery in the OpenAI‑compatible multimodal media URL handler where the guard validates a URL only once, but subsequent HTTP requests follow redirects and resolve DNS again without re‑validation; an unauthenticated attacker can supply a malicious URL that redirects or uses DNS rebinding to target internal or cloud metadata endpoints, exposing sensitive information or enabling further attacks, a flaw classified as CWE-918 that directly threatens confidentiality and availability.

The vulnerability applies to the hiyouga:LlamaFactory product, affecting any installation that has not moved beyond version 0.9.5; the advisory references a 0.9.5 repository and no additional version qualifiers are provided.

With a CVSS score of 8.7 and no EPSS data available, the flaw is high severity though exploitation likelihood is uncertain; it is unauthenticated, so any HTTP request to the affected endpoint can trigger it, potentially allowing attackers to access internal resources, leak data, or proceed with further compromise; the CVE is not listed in the CISA KEV catalog but remains a priority for exposed deployments.