Ssrf

Any feature that takes a user-supplied URL and fetches it server-side runs that fetch with the server’s identity, network position and credentials. A thumbnailer, a webhook tester, an importer, a PDF renderer — the moment the target comes from the request, the attacker is not visiting your internal network. Your server is visiting it for them. ...