The Brecht Visual Link Preview product, versions up to 2.3.0, contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-39670). SSRF vulnerabilities allow attackers to make the server perform requests to unintended locations, potentially exposing internal resources or causing other impacts. The CVSS 3.1 base score is 6.0, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch information available, and no known exploits have been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make arbitrary requests, potentially leading to limited disclosure of internal information, modification of data, or disruption of service. The CVSS vector indicates low confidentiality, integrity, and availability impacts. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access from the affected application to sensitive internal resources if possible.