A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the file packages/core/src/modules/upload/servi…

A server-side request forgery (SSRF) vulnerability has been discovered in BidingCC BuildingAI up to version 26.0.1. The vulnerability affects the uploadRemoteFile function in the Remote Upload API component, specifically in the file-storage.service.ts file. The vulnerability can be exploited remotely by manipulating the url argument. The exploit has been publicly disclosed and is available for use. The project maintainers have been notified through an issue report but have not yet responded to address the vulnerability.