The SSRF protection bypass in misp-modules' html_to_markdown expansion module arises because IP addresses were checked against restricted ranges without normalizing IPv4-mapped IPv6 addresses to their IPv4 equivalents. Attackers with authentication could supply URLs using IPv4-mapped IPv6 notation (e.g., http://[::ffff:127.0.0.1]/) or hostnames resolving to such addresses, which were incorrectly treated as IPv6 and thus not blocked. This allowed the server to connect to internal network services, potentially exposing sensitive internal web services, administrative interfaces, or cloud metadata endpoints. The issue was remediated by normalizing these addresses before applying blocked-range checks and rejecting URLs lacking valid hostnames.

An authenticated attacker can bypass SSRF protections to make the misp-modules server connect to internal or restricted network services, potentially exposing sensitive internal resources such as administrative interfaces or cloud instance metadata. This could lead to unauthorized information disclosure. The vulnerability has a high severity score (CVSS 8.3).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states it has been addressed by normalizing IPv4-mapped IPv6 addresses and rejecting invalid hostnames. Until an official fix is confirmed, restrict access to the vulnerable module to trusted users only and monitor for suspicious activity.