This vulnerability (CWE-918) exists in the PDF export functionality of ccyl13 Pentestify prior to version 1.1.0. It allows authenticated users to cause the server to make HTTP GET requests to arbitrary external URLs by injecting unvalidated URLs into the finding images or client_logo fields. The server-side headless browser used during report rendering fetches these URLs, leading to SSRF. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet.

An authenticated user can abuse this vulnerability to make the server perform HTTP GET requests to attacker-controlled or arbitrary external destinations. This could potentially be used to access internal resources, scan internal networks, or interact with services not directly accessible to the attacker. The impact on confidentiality, integrity, and availability is limited according to the CVSS vector, but SSRF can be a stepping stone for further attacks depending on the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected fields to trusted users only and consider network-level controls to limit outbound HTTP requests from the server. Monitor for unusual outbound requests originating from the server. Avoid using untrusted input in the finding images or client_logo fields.