This vulnerability allows remote attackers to exploit a weakness in the storeUrl function of the Artifacts Endpoint in ChatGPTNextWeb NextChat (<= 2.16.1) by manipulating the argument ID to perform server-side request forgery. This can cause the server to make unintended HTTP requests, potentially exposing internal resources or services. The issue was reported early to the project but remains unpatched as of the publication date. No official remediation or patch is currently available from the vendor.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal systems or services that are not otherwise exposed. This could lead to information disclosure or further attacks depending on the internal network configuration. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level protections such as restricting outbound requests from the server or using web application firewalls to detect and block SSRF attempts until an official patch is available.