CVE-2026-112297: Server-Side Request Forgery in ptbsare anx-calibre-manager

The vulnerability CVE-2026-112297 affects ptbsare anx-calibre-manager up to version 1.13.12. It is a server-side request forgery issue located in the LLMClient.chat function of the blueprints/api/llm.py file, part of the LLM Configuration Handler component. By manipulating the base_url argument, an attacker can cause the server to send unauthorized requests to arbitrary URLs. The vulnerability can be exploited remotely without user interaction. Although the vendor was contacted early, no response or fix has been provided. Exploit code is publicly available.

Successful exploitation of this SSRF vulnerability allows remote attackers to induce the server to make HTTP requests to arbitrary URLs. This can lead to unauthorized internal network scanning, access to internal services, or other indirect impacts depending on the server environment. The CVSS 4.0 score of 5.3 (medium severity) reflects the moderate risk due to the lack of required user interaction and low complexity of attack, but limited impact as no direct data compromise or code execution is indicated.

No official patch or remediation is currently available as the vendor has not responded. Users should monitor vendor channels for updates. Until a fix is released, consider implementing network-level restrictions to limit outbound HTTP requests from the affected service or isolate the service to reduce potential SSRF impact.