Muhammadamin Qudratov

**Name of the Vulnerable Software and Affected Versions** gabehf/Koito versions prior to 0.3.3 **Description** A server-side request forgery (SSRF) issue allows an authenticated user to force the server to perform HTTP requests to arbitrary internal or external hosts. This occurs when a crafted `image url` value is supplied to the 'PATCH /apis/web/v1/album/{id}/image' endpoint. The application fetches the provided URL server-side without validating the destination host or blocking access to private, loopback, link-local, or internal addresses. SSRF is a flaw where an attacker can induce a server-side application to make requests to an unintended location. **Recommendations** Update gabehf/Koito to version 0.3.3 or later. Avoid using the `image url` parameter in the 'PATCH /apis/web/v1/album/{id}/image' endpoint until the update is applied.