"PUT /api/basemap" (the basemap import endpoint) fetches an attacker-supplied URL server-side with no SSRF protection whatsoever. Any authenticated user can submit a JSON body "{ "type": "...", "url": "<attacker url>" }"; the server calls "fetch(url)" against that URL and then reflects the response body ("name", "attribution", "tiles[0]", zoom levels) back to the caller in the "OptionalTileJSON" response. Because there is no IP-address classification, internal-only services are reachable: cloud metadata ("http://169.254.169.254/..."), loopback ("http://127.0.0.1/..."), RFC1918 ranges, and CGNAT. The response body flows back to the attacker, making this a full-read SSRF (not blind): the attacker reads the internal HTTP response verbatim. This enables theft of cloud instance credentials, internal service enumeration, and reading of internal-only HTTP endpoints from the network position of the CloudTAK API server. The only URL check in the basemap protocol layer ("BasemapProtocol.isValidURL", "api/lib/interface-basemap.ts") validates the scheme is "http"/"https" only and performs no host/IP filtering — and the import path does not even call it; it goes straight from "new URL(rawURL)" to "fetch(url)". Three independent bypass classes were confirmed end-to-end against a real deployed build: 1. Direct internal/loopback IP literals. 2. Alternate IP encodings (e.g. decimal "http://2130706433/" = "127.0.0.1"). 3. Redirect following — "fetch" uses the default "redirect: 'follow'", so even a public initial host that 302-redirects to an internal address is followed with no re-validation.