Server-Side Request Forgery (SSRF) and How to Block It
Many features fetch a URL on the user's behalf: link previews, "import from URL", webhooks, PDF generators. If an attacker controls the URL, they can make your server request internal addresses it can reach but they can't. That's server-side request forgery ....