Zyplayer-Doc EUVD-2026-66817

Exploitation requires that the vulnerable WikiPageWebService.download() functionality be reachable by the attacker on a Zyplayer-Doc <=1.0.0 instance; the CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating no authentication and no user interaction are needed against a network-exposed instance. The concrete prerequisite is network access to the wiki page download feature and the ability to supply the fetch target. What limits real impact is network position: the SSRF is only as valuable as the internal services the server can reach, so instances with strict egress filtering, no sensitive internal/metadata endpoints, or the download feature disabled/proxied present a much smaller attack surface. Note affected-version precision is limited (EUVD lists 'n/a'), so version applicability should be verified per deployment.

Signals are mixed but lean toward elevated concern. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) describes an easy, network-reachable, unauthenticated attack with high confidentiality and integrity impact, and SSVC reinforces this: exploitation status 'poc', Automatable 'yes', Technical Impact 'total'. Against that, EPSS is only 0.14% (4th percentile), and the CVE is NOT in CISA KEV - so despite the high CVSS there is no evidence of widespread active exploitation, suggesting real-world attacks (if any) would be opportunistic or targeted rather than mass-scale, likely reflecting the product's small deployment footprint rather than any inherent difficulty. One caveat worth verifying: the vector assigns I:H, but a pure SSRF-via-download typically yields information disclosure and pivoting (confidentiality) more than direct server-side integrity change, so the I:H rating may be generous unless the fetched content is written back or acted upon - confirm with the vendor/PoC. Given trivial exploitability and total technical impact, defenders exposing this app to untrusted networks should treat it as urgent regardless of the low EPSS.

An attacker with only network reach to the Zyplayer-Doc web interface submits a crafted download request whose target URL points at an internal service or the cloud metadata endpoint (e.g. http://169.254.169.254/latest/meta-data/). The server dereferences the URL via WikiPageWebService.download() and returns or acts on the response, letting the attacker enumerate internal hosts and potentially exfiltrate cloud credentials. A public technical write-up demonstrating the flaw exists on GitHub, and the low attack complexity (AC:L, no auth) makes this straightforward to reproduce.