The vulnerability arises in OpenPanel’s data importer where a caller‑supplied file URL is fetched with plain fetch without URL is only validated by a generic string URL check, allowing attacker‑chosen addresses such as localhost or the AWS metadata endpoint. An authenticated organization member, even a default member with limited access, can trigger the server to connect to any reachable internal host. The resulting HTTP status and response body are stored as Import.errorMessage and returned to the same user, providing a convenient scanning oracle. If the internal response parses as Umami CSV, the rows are ingested as, effectively leaking internal data and potentially enabling further exploitation. This is a classic SSRF flaw described by CWE‑918.

The affected product is the OpenPanel analytics platform from Openpanel‑dev:openpanel. All current releases are impacted as no patched version has been released at the time of publication.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated organization member; the attacker must have at least the default member role. Once authenticated, the attacker can supply any URL and observe the server’s internal connectivity, making the risk moderate but significant for environments with sensitive internal services. The lack of a hard time‑out or destination filter increases the potential for internal enumeration and data exfiltration.