Benotes EUVD-2026-109631

Exploitation requires an authenticated low-privileged account (CVSS PR:L) with access to Benotes' Bookmark Metadata endpoint, which calls getUrlInfo in app/Http/Controllers/PostController.php; the attacker supplies a malicious value for the 'url' argument that the server then fetches. The limiting factors are the authentication requirement (not reachable fully unauthenticated), the low-confidentiality-only impact (no write/integrity or availability effect, no stated scope change to other systems), and the small deployment footprint of this self-hosted product. No non-default configuration is stated as necessary in the available sources; the precise conditions beyond controlling the 'url' parameter are not described.

This is a low-priority issue despite being a remotely reachable SSRF (CWE-918). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reachability with low complexity and no user interaction, but PR:L means the attacker must already hold a low-privileged authenticated account, and the impact is limited to low confidentiality only (VC:L, with VI:N/VA:N and no subsequent-system impact SC:N/SI:N/SA:N), yielding a base score of just 2.1. The exploit maturity is Proof-of-Concept (E:P), consistent with a public PoC reference that is not verified as working exploit code. The vuln.today decision label is 'monitor', not an act-now/emergency signal. There is no CISA KEV listing and no EPSS value in the provided data, so there is no evidence of active or widespread exploitation - treat this as a low-urgency, authenticated, low-impact SSRF rather than a priority. Note the data gap: no EPSS score and no vendor advisory are available, and the project has not responded to the issue report, so no fixed version exists.

An authenticated low-privileged Benotes user calls the Bookmark Metadata endpoint (getUrlInfo in PostController.php) and supplies a crafted 'url' argument pointing at an internal or metadata address instead of a legitimate bookmark target, causing the server to issue a request on the attacker's behalf. Because impact is rated low-confidentiality only, the realistic payoff is probing internal services or reading limited responses reflected back through the metadata fetch. A public PoC reference exists (a gist), but it is not verified as working exploit code, and the exact trigger beyond manipulating the 'url' parameter is not detailed in the available sources.