Campfire EUVD-2026-114058

Exploitation requires an authenticated Campfire user (PR:L) who can post a chat message, and the server must have link-unfurl / OpenGraph preview fetching enabled (the default behavior that triggers the server-side fetch). The attacker must control DNS so a hostname in a posted link resolves into one of the ranges the pre-1.4.5 PrivateNetworkGuard failed to block: CGNAT 100.64.0.0/10, NAT64 64:ff9b::/96 or 64:ff9b:1::/48, or 6to4 2002::/16 (NAT64 and 6to4 additionally embedding the intended internal IPv4 target). Limiting factors: exploitation only affects versions <= 1.4.4; it needs authentication rather than anonymous access; and the practical payoff is bounded because the unfurl returns only OpenGraph metadata and most internal endpoints return none, with no integrity or availability impact.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N: network-reachable but high attack complexity, requiring an authenticated user (PR:L), with only limited confidentiality impact and no integrity or availability impact. The vuln.today decision label is 'monitor', the weakest urgency tier, which aligns with the low CVSS. There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation probability cannot be quantified from the data. No public exploit code or PoC reference is present - the only references are the vendor fix commit, pull request #225, the v1.4.5 release tag, and the GHSA advisory, all of which are remediation artifacts, not exploit code. The real-world payoff is intrinsically capped: the SSRF only returns OpenGraph metadata, and the advisory and description both note most internal endpoints return none, so even successful exploitation leaks little. This is a correctly-rated low-severity SSRF, not a high-CVSS-but-overblown case nor an under-rated sleeper - treat it as routine patch-when-convenient hygiene consistent with the 'monitor' label.

An authenticated Campfire user posts a chat message containing a link whose hostname resolves into an unguarded special-use range (CGNAT 100.64.0.0/10, NAT64 64:ff9b::/96 or 64:ff9b:1::/48, or 6to4 2002::/16, the latter two embedding an internal IPv4 target such as a cloud metadata address). The server fetches the URL to build an OpenGraph unfurl preview, issuing a request to the internal resource and returning any OpenGraph metadata that endpoint exposes. No public exploit identified at time of analysis; the high attack complexity reflects the need to control DNS resolution into these ranges and the limited data actually retrievable.