The flaw lies in the validateUrlForSSRF function of the Logo API route in calcom cal.diy. By manipulating the input URL, an attacker can trigger the server to make HTTP(s) requests to arbitrary addresses, potentially exposing internal services or data. The primary impact is the ability to reach and read internal resources that the application is otherwise allowed to access, which can lead to further exploitation depending on the environment exposed by the SSRF.

Calcom’s cal.diy product, versions up to and including 4.9.4, is affected. No newer versions are known to contain the fix as of the presented data.

The CVSS score of 2.3 reflects a low overall severity; EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Though exploitation is described as difficult, a public exploit has already been released, indicating that an attacker could use it in a remote setting. The risk to an organization primarily stems from potential internal network exposure, and mitigation should focus on restricting outbound connections and ensuring the application is updated.