ANX Calibre Manager CVE-2026-112297

Exploitation requires an authenticated low-privileged account (PR:L) with access to the LLM Configuration Handler, specifically the ability to control the base_url argument consumed by the LLMClient.chat function in blueprints/api/llm.py. The flaw is therefore reachable only on instances where the LLM integration feature is exposed/enabled and the attacker can reach and submit configuration to that endpoint. Limiting factors: valid credentials are mandatory (not remote-unauthenticated), impact is confined to SSRF-style outbound requests with low confidentiality disclosure, and realistic damage depends on what internal services or metadata endpoints are reachable from the server's network position.

This is a moderate, not urgent, priority. The vendor-assigned CVSS 4.0 score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and only low confidentiality impact (VC:L), meaning an authenticated low-privileged user can trigger server-side request forgery over the network with no user interaction, but the direct impact is limited to information exposure rather than integrity or availability loss. The E:P (Proof-of-Concept) sub-score aligns with the stated fact that an exploit 'has been published,' so publicly available exploit code exists - but this is NOT active in-the-wild exploitation: there is no CISA KEV listing and no EPSS score was provided in the input. SSRF (CWE-918) real-world impact is highly context-dependent: the published CVSS caps confidentiality at Low, suggesting the researcher judged the SSRF to yield limited internal responses rather than full cloud-metadata or credential theft, though SSRF severity can escalate sharply depending on the network the server sits in. The PR:L requirement meaningfully limits risk, since an attacker must already hold a valid low-privileged account on the application. Note the vendor did not respond to disclosure, so no patched version is confirmed - a key missing signal that argues for treating any affected deployment as unpatched.

An attacker who holds a valid low-privileged account on an Anx Calibre Manager instance edits the LLM configuration and sets the base_url to an attacker-chosen internal address. When LLMClient.chat is invoked, the server issues a request to that URL, letting the attacker probe internal services or reach otherwise unreachable hosts behind the application. A proof-of-concept exploit has been published, lowering the skill needed to reproduce the attack.