SSRF in LMDeploy vision-language image loader

This repository is a local Docker-based SSRF lab for CVE-2026-33626 affecting InternLM LMDeploy vision-language image loading. It is a real proof-of-concept repository, not just documentation. The core exploit capability is to supply an attacker-controlled URL to a FastAPI wrapper endpoint (/probe), which then calls lmdeploy.vl.load_image(url). In the vulnerable build (LMDeploy 0.12.0), this causes a server-side fetch of internal/private resources, demonstrating SSRF. In the patched build (LMDeploy 0.12.3), the same request is rejected with a security error. Repository structure: docker-compose.yml orchestrates three services: vuln, patched, and internal. The vuln/Dockerfile and patched/Dockerfile each build a minimal FastAPI/uvicorn wrapper around LMDeploy and expose endpoints /, /version, and /probe. The internal/server.py file implements a simple HTTP canary service on port 9000 that serves /private.png and records requests in memory, exposing /hits and /reset for verification. The poc/poc.py script is the main operator entry point; it resets the canary, probes both vulnerable and patched services, and compares whether the internal service was contacted. Exploit flow: poc/poc.py sends a GET request to /probe?url=<encoded target> on the vulnerable service. The vulnerable wrapper passes the supplied URL into lmdeploy.vl.load_image(), which fetches and decodes the remote image. Success is confirmed when the internal canary logs a hit to /private.png. The same flow against the patched service should fail before any internal request occurs. This is an operational SSRF PoC with a fixed, benign payload URL rather than a customizable post-exploitation payload. It demonstrates internal network reachability and server-side URL fetching, but does not include RCE, persistence, credential theft, or lateral movement logic.