This vulnerability (CWE-918) affects Scripta eScriptorium through version 26.04.1, allowing authenticated users to exploit the METS and IIIF import URI handling functionality. The server accepts URIs via the mets_uri or iiif_uri parameters in POST requests to /api/documents/{pk}/imports/ without proper domain restrictions or request controls. Because the IMPORT_ALLOWED_DOMAINS setting defaults to '*', the server can be coerced into making arbitrary HTTP requests to internal network resources, including sensitive cloud instance metadata services. No official remediation level or patch is currently documented, and no known exploits in the wild have been reported.

An authenticated attacker can leverage this SSRF vulnerability to make the server issue arbitrary HTTP requests to internal systems, potentially accessing sensitive internal services such as cloud instance metadata endpoints. This can lead to information disclosure (high confidentiality impact) and limited integrity impact. Availability is not affected. The CVSS v3.1 base score is 8.5 (high severity), reflecting the ease of exploitation with low attack complexity and the significant confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the import API endpoint to trusted users only and consider implementing network-level controls to limit the server's ability to make outbound HTTP requests to internal or sensitive endpoints. Review and adjust the IMPORT_ALLOWED_DOMAINS setting to restrict allowed domains explicitly rather than using the default wildcard '*'.