This vulnerability affects the uploadRemoteFile function in the file-storage service of BidingCC BuildingAI (up to version 26.0.1). By manipulating the url parameter, an attacker can cause the server to make unauthorized requests to internal or external resources, leading to server-side request forgery. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. No official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the BuildingAI server perform unintended requests, potentially accessing internal systems or services not otherwise exposed. The CVSS score of 6.9 reflects a medium severity impact, with low to limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access from the affected service to sensitive internal resources to reduce potential impact. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.