A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. (CVE-2026-112297)

CVE-2026-112297 describes a server-side request forgery vulnerability in ptbsare anx-calibre-manager versions up to 1.13.12. The issue is located in the LLMClient.chat function of the blueprints/api/llm.py file, part of the LLM Configuration Handler. The vulnerability arises from improper handling of the base_url argument, allowing remote attackers to induce the server to make unintended requests. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not issued a response or patch. The CVSS v3.1 base score is 4.3, reflecting low severity with network attack vector, low attack complexity, and low privileges required.

The vulnerability allows remote attackers to perform server-side request forgery (SSRF) by manipulating the base_url parameter. This could enable attackers to make unauthorized requests from the affected server to internal or external systems. The impact is limited to information disclosure (confidentiality impact is low) with no integrity or availability impact reported. There is no evidence of active exploitation in the wild.

No official fix or patch is currently available as the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a patch is released, consider restricting network access from the affected application to sensitive internal resources to reduce SSRF risk. Validate and sanitize inputs to the LLMClient.chat function if possible to prevent manipulation of the base_url parameter.