CVE-2023-51804 is a server side request forgery in rymcu forest 0.02. Manipulating the URL in the HTTP body sent to UploadController lets an attacker pull sensitive information. The record rates it High at 7.5. No fixed version is named, so check the project's issue 149.
What's affected
rymcu forest version 0.02. The record names the com.rymcu.forest.web.api.common.UploadController class. It does not list a fixed version.
The project's GitHub issue 149 carries a title that says registered users can trigger the SSRF, while the vector in the record shows no privileges required. We flag that difference. If you run this software, assume that either an account or an open registration is enough.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity none, and on availability none. The weakness class is CWE-918.
How to check if you're exposed
Check the version in your build file. For a Maven project, look at the version in pom.xml or run mvn dependency:tree, and look for forest. If you run a deployed instance of the forum application, confirm its release.
Then test whether the upload endpoint can reach internal addresses from your network. Do that only with approval and on systems you own, and review egress rules rather than sending crafted requests blindly.
What to do now
- Find deployments of rymcu forest and their version.
- Check the project's issue 149 and releases for a fix, and upgrade if one exists.
- Block outbound requests from the application server to internal ranges and cloud metadata addresses.
- Restrict who can register and who can reach the upload feature.
- Review server logs for upload requests that carry unexpected URLs.
Why it matters
Server side request forgery means the server fetches a URL that an attacker chose. The server sits inside your network, so it can reach things the attacker cannot, such as internal services and cloud metadata.
The record calls the result exposure of sensitive information. The fetched response ends up somewhere the attacker can read. On cloud hosts, a metadata service reachable this way can reveal credentials.
The best defenses are not in the application alone. Network egress rules and metadata service protections turn a successful SSRF from a breach into a log entry.
Try it yourself
See how a dynamic scan probes a web application for request handling flaws like this one.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The record does not name one. Check the project's issue 149 and releases.
Why does the issue title mention registered users?
The GitHub issue title says registered users can trigger it, while the record's vector lists no privileges. Plan for the worse case.
Sources
Last reviewed: 19 October 2026.
