Scripta eScriptorium versions through 26.4.1 are vulnerable to Server-Side Request Forgery, which could allow attackers to perform unauthorized requests on behalf of the server.

This is a Server-Side Request Forgery (CWE-918) vulnerability in the METS and IIIF import URI handling. It requires authenticated access to the system to be triggered.

With a CVSS score of 8.5, this vulnerability presents a significant risk. An attacker could leverage this flaw to access internal services or sensitive data that is not exposed to the public internet, bypassing network perimeters and potentially leading to further compromise.

Immediate Action: Upgrade to version 26.04.2, 1.0.1, or 0.13.9 immediately to resolve the vulnerability.

Proactive Monitoring: Review application logs for unusual URI patterns during METS or IIIF import operations that might indicate probing attempts.

Compensating Controls: If an immediate upgrade is not feasible, set the IMPORT_ALLOWED_DOMAINS setting to an explicit list of permitted domains rather than the default wildcard value of asterisk.

Public Exploit Available: Unknown.

Administrators should prioritize upgrading eScriptorium to the specified fixed versions. If immediate patching is not possible, implementing the recommended configuration change to restrict allowed domains is a critical step to reduce the attack surface.