Webstudio versions through 0.296.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability affecting the /cgi/image, /cgi/video, and /cgi/asset proxy routes. The vulnerability is triggered when the RESIZE_ORIGIN environment variable is not set, allowing attackers to supply arbitrary URLs to these endpoints without authentication. Exploitation can enable reading of cloud instance metadata, access to internal services, and network reconnaissance of the underlying infrastructure. The affected routes are implemented in the builder application of the Webstudio project. The issue has been documented in GitHub issue #5816 and referenced by VulnCheck. No authentication is required to exploit this vulnerability, significantly increasing its risk profile. Affected organizations running self-hosted Webstudio instances should ensure the RESIZE_ORIGIN environment variable is properly configured or upgrade to a patched version.
