Alex Content Mask versions up to 1.8.5.2 contain a Server-Side Request Forgery vulnerability. SSRF vulnerabilities occur when an attacker can cause the server to send crafted requests to internal or external systems, potentially bypassing access controls. This issue affects the Content Mask product and requires at least limited privileges to exploit. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with low confidentiality and integrity impact but no availability impact.

Successful exploitation of this SSRF vulnerability could allow an attacker with limited privileges to make the server perform unauthorized requests, which may lead to partial disclosure of information or manipulation of internal resources. The impact is rated medium with limited confidentiality and integrity effects and no availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the vulnerable versions and consider applying any available workarounds recommended by the vendor.