Termix, a web-based server management platform, has an SSRF vulnerability (CWE-918) in versions >=2.5.0 <2.5.1. Authenticated users can configure webhook or ntfy notification channels with arbitrary destination URLs and trigger server-side requests via a test endpoint. The request path from alert-rules-routes.ts to notification-sender.ts lacks destination allowlisting and private address blocking, enabling blind SSRF to internal HTTP services reachable by the server. Webhook mode allows attacker-controlled HTTP methods and headers, which may cause limited state changes if internal services accept the fixed notification body. Response bodies are not returned. The vulnerability is resolved in version 2.5.1.

An authenticated attacker can cause the Termix server to make arbitrary HTTP requests to internal services that are otherwise inaccessible externally. This can lead to limited state changes on internal services due to attacker-controlled HTTP methods and headers. There is no confidentiality impact as response bodies are not returned. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity), indicating a moderate risk of integrity and availability impact but no direct confidentiality loss.

Upgrade Termix to version 2.5.1 or later, where this SSRF vulnerability is fixed. No other mitigations are specified. Since the vulnerability requires authentication, restricting user access can reduce risk until the upgrade is applied.