This vulnerability exists in the validateUrlForSSRF function within the file apps/web/app/api/logo/route.ts of calcom cal.diy (up to version 4.9.4). It enables an attacker to perform server-side request forgery remotely by manipulating URL validation. The exploit complexity is high, requiring low privileges but no user interaction. The CVSS 4.0 base score is 2.3, indicating low impact. The vendor has not issued any fix or advisory, and no patch links are available. The vulnerability was publicly disclosed on 2026-05-23 with exploit code released, but no active exploitation has been observed.

Successful exploitation could allow an attacker to make unauthorized server-side requests, potentially accessing internal resources or services not directly exposed. However, the low CVSS score and high attack complexity suggest limited impact and difficulty in exploitation. No privilege escalation, user interaction, or confidentiality/integrity/availability impacts beyond limited SSRF are indicated. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Users should monitor vendor channels for updates. Given the exploit complexity and low severity, immediate emergency response may not be required, but cautious network segmentation and restricting outbound server requests where possible could reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.