This vulnerability in louisho5 picobot up to version 0.2.0 allows an attacker to perform server-side request forgery via the WebTool.Execute function in the web tool component. By manipulating the url argument, an attacker can cause the server to make unintended requests. The vulnerability is remotely exploitable and has been publicly disclosed. No official remediation or patch has been provided by the vendor as of the publication date.

An attacker can exploit this vulnerability to make the vulnerable server perform arbitrary HTTP requests. This can lead to unauthorized internal network scanning, access to internal services, or other SSRF-related impacts depending on the server environment. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing network-level restrictions to limit outbound requests from the affected component and monitor for suspicious activity related to SSRF attempts until an official patch is available.