This vulnerability affects the uploadRemoteFile function in the file-storage service of BidingCC BuildingAI (up to version 26.0.1). By manipulating the url parameter, an attacker can cause the server to make unintended requests to internal or external resources, leading to server-side request forgery. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. No official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to induce the server to send crafted requests to arbitrary URLs, potentially accessing internal systems or services not directly accessible to the attacker. This can lead to information disclosure or interaction with internal network resources. The CVSS score of 6.9 reflects a medium impact with low vector and integrity impact but limited availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level controls to restrict outbound requests from the affected service or apply other compensating controls to limit SSRF impact until an official patch is available.