prompts.chat versions before commit 1464475 contain a blind SSRF vulnerability (CWE-918) in the Wiro media generator. Authenticated users can exploit this by sending POST requests to the /api/media-generate endpoint with a controlled inputImageUrl parameter. This causes the server to perform requests to arbitrary URLs, which can be used to probe internal network resources or services that are otherwise inaccessible externally. The vulnerability does not provide direct response data to the attacker, limiting the feedback from exploitation attempts. There is no vendor advisory or patch currently available, and the product is not a cloud service.

An attacker with authenticated access can leverage this SSRF vulnerability to make the server perform unauthorized requests to internal network resources or services. This can lead to information disclosure about internal infrastructure and potential data exfiltration via the upstream Wiro service. However, the blind nature of the SSRF limits direct data retrieval by the attacker. The CVSS 4.0 base score is 5.3, indicating medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted users only and monitor usage of the /api/media-generate endpoint for unusual activity. Avoid exposing sensitive internal services that could be accessed via SSRF. Do not rely on generic mitigations unless specifically recommended by the vendor.