smrealms smr EUVD-2026-104596

Requires a low-privileged authenticated account on the smr (Space Merchant Realms) instance with access to the Album Website feature in src/pages/Account/AlbumEditProcessor.php. The vulnerability is triggered specifically by the album 'Website' input, which is passed unvalidated into isUrlReachable() where curl_init() fetches the attacker-controlled URL server-side (a HEAD request with a 5-second timeout). Limiting factors: exploitation is authenticated (PR:L) rather than anonymous; the response body is not returned to the attacker (curl is configured NOBODY/headers-only), so this is a blind SSRF exposing only reachability/status-class, meaningfully constraining data exfiltration. No user interaction by a victim is required.

The CVSS 4.0 base score is 5.3 (Medium), driven by a network attack vector (AV:N), low complexity (AC:L), and crucially PR:L - exploitation requires an authenticated account that can edit an album profile. Impact is limited to low confidentiality (VC:L) with no integrity or availability impact, consistent with a blind SSRF: the vulnerable isUrlReachable() function issues a server-side curl HEAD request to an attacker-supplied 'Website' value and only reveals reachability via HTTP status class (2xx/3xx), rather than returning full response bodies. The input shows E:P (Proof-of-Concept), and the description states the exploit has been publicly disclosed, so publicly available exploit code exists - but this is NOT active exploitation: there is no CISA KEV listing and no EPSS score was provided, so widespread or automated exploitation cannot be inferred. Overall this is a genuine but moderate-priority issue: the authentication requirement, blind/limited data exposure, and niche affected product (an open-source browser game) substantially reduce real-world risk despite the public POC. Signals are consistent with no contradictions; the main missing data points are EPSS probability and any real-world exploitation telemetry.

An attacker who holds a registered Space Merchant Realms account edits their album profile and submits a crafted 'Website' value pointing at an internal host or service (e.g., http://169.254.169.254/ or http://localhost:8080/). The server's isUrlReachable() function fetches that URL via curl, letting the attacker probe internal network reachability based on the returned status class. A public proof-of-concept has been disclosed, lowering the barrier to reproduction.