This vulnerability in Algovate xhs-mcp 0.8.11 allows an unauthenticated remote attacker to perform server-side request forgery via manipulation of the media_paths argument in the xhs_publish_content function located in src/server/mcp.server.ts. SSRF vulnerabilities enable attackers to make the server perform unintended HTTP requests, potentially accessing internal resources. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. No vendor advisory or patch links are available, and the product is not a cloud service, so remediation is the responsibility of the user.

Successful exploitation could allow an attacker to induce the server to make arbitrary HTTP requests, potentially accessing or interacting with internal or protected network resources. This could lead to information disclosure or further attacks depending on the internal network configuration. The vulnerability does not require authentication and can be triggered remotely, increasing its risk. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should consider implementing network-level restrictions to limit outbound requests from the affected server or apply application-level input validation to restrict or sanitize the media_paths argument. Monitor for updates from the vendor and apply patches promptly once available.