Endatix EUVD-2026-112410

The target form must have both IsPublic and IsEnabled set (the normal state of a published intake form), and if reCAPTCHA v3 is configured the anonymous submission must pass it. The outbound request fires only when a staff member holding the submissions.view permission invokes POST /forms/{formId}/submissions/{submissionId}/files, so exploitation is second-order and gated on victim staff interaction (UI:R) that the attacker cannot trigger directly. Only file objects whose content begins with http:// or https:// reach the network sink; data: URIs and raw base64 content are decoded locally and are not exploitable. Exploitation is blind: the fetched body is delivered into the staff viewer's ZIP, not to the attacker, so confirmation relies on observable request behavior (status, timing, connection success) or information the viewer exposes. The server must also have network reachability to the targeted internal/link-local/metadata address for the SSRF to yield useful results.

This is a genuine but second-order, moderate-risk SSRF (CWE-918), not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base 4.7) is internally consistent with the mechanism: the attacker-facing step (anonymous POST of a submission) is network-reachable, low-complexity, and unauthenticated (PR:N), but the dangerous outbound fetch only fires when a staff member with submissions.view later downloads the submission's files (UI:R), making this blind/stored and dependent on a victim action the attacker cannot force. The S:C (scope change) and C:L are well-justified: the server can be coerced to reach cloud metadata (169.254.169.254), loopback, link-local, and internal services otherwise unreachable from the internet (authority-boundary crossing), but the response is placed in the staff viewer's ZIP rather than returned to the attacker, so disclosure is indirect/observational. No EPSS score and no KEV status were supplied; absence of these is not evidence of safety, but there is no signal of active exploitation. The vuln.today decision label is this_month (not act_now/emergency), aligning with a real-but-not-critical priority. A public PoC reference exists in the GHSA advisory (a step-by-step walkthrough); it is not verified as working exploit code. Net: a real issue worth patching on a normal priority cycle, elevated for internet-facing deployments running public intake forms, tempered by the required staff interaction and blind data return.

An unauthenticated attacker locates a public, enabled Endatix intake form and submits JSON containing a file object whose content field is an internal URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/, which is stored verbatim after only a well-formedness check (passing reCAPTCHA v3 first if configured). When a staff member with submissions.view later downloads that submission's files, the server issues an unvalidated HttpClient.GetAsync to the attacker-chosen internal address and places the response in the staff viewer's ZIP. A public PoC reference exists in the GHSA advisory; it is not verified as working exploit code, and exploitation is blind, with success inferred from timing, reachability, or what the viewer surfaces.