The vulnerability exists in the openConnection function within the Theme Download Function of taisan tarzan-cms 1.0.0. By manipulating the httpUrl parameter, an attacker can cause the server to make unintended HTTP requests, leading to server-side request forgery. This flaw can be exploited remotely without authentication. The issue was reported early to the project, but no fix or official response has been provided to date. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation allows remote attackers to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise accessible. This can lead to information disclosure or other indirect impacts depending on the internal network configuration. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting or monitoring outbound HTTP requests from the affected component as a temporary mitigation until an official patch is available.