This vulnerability in devlikeapro WAHA allows an attacker to manipulate server-side requests via the API Request Handler, specifically in the media.controller.ts file. The flaw enables server-side request forgery, which can be triggered remotely without authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. The vendor has not provided any remediation or patch, and the exploit has been publicly disclosed.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the server to make unintended requests, potentially leading to information disclosure or interaction with internal systems. However, the impact is rated medium with limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no confirmed exploitations in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a patch is released, consider implementing network-level controls to restrict outbound requests from the affected server to mitigate potential SSRF exploitation.