The vulnerability CVE-2026-74842 affects the download_image function in server.py of the Image-Toolkit-MCP-Server component within Kira-Pgr PromptShopMCP. By manipulating the image_url parameter, an attacker can trigger server-side request forgery (CWE-918), causing the server to make arbitrary HTTP requests. The vulnerability can be exploited remotely without user interaction and has a CVSS 3.1 base score of 6.3, indicating medium severity. The project uses a rolling release model, and no specific affected versions or patches have been disclosed. The vendor has not responded to the issue report, and no known exploits are currently observed in the wild.

Successful exploitation allows an attacker to cause the vulnerable server to perform arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure, limited integrity impact, and availability impact as indicated by the CVSS vector. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official project channels for updates. Until a fix is released, consider restricting outbound HTTP requests from the server or implementing input validation to mitigate SSRF risks.