CVE-2023-49471: Barassistant Bar Assistant

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.

Affected products

• Barassistant Bar Assistant: before 3.2.0 (fixed in 3.2.0)

Published 2024-01-10. Last modified 2026-06-17.