Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/{formId}/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contain an HTTP or HTTPS URL. When a staff member with submissions.view permission invokes POST /forms/{formId}/submissions/{submissionId}/files, GetFilesHandler passes the stored data to SubmissionFileExtractor in src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs, which calls HttpClient.GetAsync without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services,…