CVE-2026-74842 is an SSRF vulnerability in Kira-Pgr PromptShopMCP's download_image function within the Image-Toolkit-MCP-Server component. By manipulating the image_url parameter, an attacker can cause the server to make unauthorized requests. The vulnerability is present in the version identified by commit 5bc0cd17358e19a5415d11a531088170d7b81452. The product uses a rolling release model, so exact version ranges are not specified. The vulnerability was responsibly disclosed but remains unpatched as the vendor has not responded. Exploit code has been publicly disclosed, but no known exploitation in the wild is reported.

An attacker can remotely exploit this SSRF vulnerability to induce the server to send crafted requests to internal or external systems. This may lead to information disclosure or interaction with internal services not otherwise accessible. The CVSS score of 5.3 indicates a medium impact, reflecting limited privileges required and partial impact on confidentiality, integrity, and availability.

No official patch or remediation has been provided by the vendor as of the latest information. Users should monitor the vendor's communications for updates. Until a fix is available, consider restricting network access from the affected server to sensitive internal resources to reduce potential impact. Avoid exposing the vulnerable function to untrusted users if possible.