This vulnerability in songxinjianqwe Chat's chat-server component (specifically in chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java) allows remote attackers to perform server-side request forgery (SSRF). The flaw enables attackers to manipulate server requests, potentially causing the server to make unintended HTTP requests. The product's rolling release model prevents precise version identification of affected releases. The vendor was contacted but did not provide any response or patch information. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low integrity, availability, and confidentiality impacts.

The SSRF vulnerability could allow remote attackers to cause the server to make unauthorized requests, which might lead to information disclosure or interaction with internal systems. The CVSS score of 6.9 (medium severity) reflects moderate impact with potential confidentiality, integrity, and availability consequences. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official channels for updates. Until a fix is released, consider restricting server outbound requests or applying network-level controls to limit SSRF impact where possible.