Impact An authenticated administrator can cause the server to issue arbitrary requests to internal and loopback services, cloud instance metadata at 169.254.169.254 (yielding IAM credentials), non HTTP services via gopher and dict, and local files via file. When the targeted endpoint returns image parseable bytes, the response is stored and served back at a public image URL, disclosing the internal response. The platform ships an explicit SSRF control, so operators who enable URL upload assume internal targets are blocked, but the control never runs. In shared hosting, managed, or multi tenant deployments the application administrator is frequently not the infrastructure owner, so reaching host infrastructure crosses a trust boundary. Details A Server-Side Request Forgery (SSRF) vulnerability exists in the URL-based image upload feature. `Image::uploadToWebsite()` fetches the user-supplied URL before an `Upload` object is created, so the built-in SSRF guard `Upload::checkValidUrl()` is never run on this path. As a result, an authenticated administrator with URL uploads enabled can make the server send requests to loopback, private network, and cloud metadata addresses, and to non-HTTP schemes such as `file://`, `gopher://`, and `dict://`. Responses are only returned to the requester when they can be parsed as an image. Exploitation requires an administrator session. PoC Environment - Chevereto 4.5.7, standard install - URL uploads enabled: in the dashboard upload settings, turn on uploads from URL (`enable_uploads_url`) - An administrator account 1. Start an internal-only listener on the Chevereto host ```bash python3 -m http.server 9099 --bind 127.0.0.1 ``` (or `nc -lk 127.0.0.1 9099`) This port is bound to loopback only and is not reachable from outside the server. 2. Get an admin session and auth token Log in as an administrator in the browser. Copy the session cookie and the `auth_token` value from the page (it is exposed in the page's JavaScript config). 3. Send a URL upload pointing at the loopback listener ```sh curl -s 'https://<chevereto-host>/json' \ -H 'Cookie: <admin session cookie>' \ --data-urlencode 'action=upload' \ --data-urlencode 'type=url' \ --data-urlencode 'source=http://127.0.0.1:9099/ADMIN-e2e-ssrf-proof' \ --data-urlencode 'auth_token=<auth_token>' ``` The auth token is a CSRF token that can be obtained via `PF.obj.config.auth_token` JS variable. 4. Observe the request on the listener ```plain 2026-09-21T12:43:08 127.0.0.1 GET /ADMIN-e2e-ssrf-proof ``` The server connected to its own loopback interface, although `Upload::checkValidUrl()` is meant to block non-public addresses. Patches Patched in Chevereto v4.5.8. The system nows filters non-public IPs on this route and it passes the IP:PORT resolution to the underlying cURL handle. Credits We would like to thank Alisher Qarshibayev for discovering this issue.