This vulnerability in devlikeapro WAHA allows an attacker to manipulate server-side requests through the API Request Handler component, leading to SSRF. The flaw resides in an unknown function in src/api/media.controller.ts and affects versions 2026.3.0 through 2026.3.4. The attack vector is network-based with low attack complexity and no privileges or user interaction required. The vendor has not provided any remediation or official fix, and no patch links are available. Exploits have been published publicly, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the server to make unauthorized requests to internal or external systems, potentially leading to information disclosure or interaction with internal services. The CVSS score of 5.3 indicates a medium impact, with limited confidentiality, integrity, and availability impacts. No confirmed exploitation in the wild has been reported yet.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates. Until a fix is released, consider implementing network-level controls such as restricting outbound requests from the affected server to trusted destinations only. Review and harden API request handling logic if possible to detect or block SSRF attempts.