FastGPT, an AI Agent building platform by labring, contains an SSRF vulnerability (CWE-918) in versions before 4.15.0-beta1. The vulnerability arises from an incomplete fix in the /api/core/dataset/file/getPreviewChunks endpoint when handling the externalFile data import type. An authenticated attacker can bypass the global isInternalAddress network protection to perform arbitrary HTTP GET requests to internal network services. This can lead to unauthorized access to internal resources. The vulnerability is addressed in version 4.15.0-beta1.

An authenticated attacker can exploit this SSRF vulnerability to bypass network protections and send arbitrary HTTP GET requests to internal services that are normally inaccessible externally. This could lead to unauthorized information disclosure from internal network resources. The CVSS score of 7.7 indicates a high severity impact focused on confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

The vulnerability is fixed in FastGPT version 4.15.0-beta1. Users should upgrade to this version or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor's fixed version. Patch status is not explicitly stated beyond the fix in 4.15.0-beta1, so users should verify the upgrade and consult the vendor for any additional guidance.