Every route in the ESRI helper family ("api/routes/esri.ts") takes a fully attacker-controlled URL from the request ("POST /api/esri" body "url", and the "portal" / "server" / "layer" query parameters on the "GET /api/esri/*" routes) and passes it into "EsriBase" / "EsriProxyPortal" / "EsriProxyServer" / "EsriProxyLayer" in "api/lib/esri.ts", which fetch it with the bare "fetch" from "@tak-ps/etl". No IP / DNS / hostname classification is applied at any point, so the destination is never validated against private, loopback, or link-local ranges. Any authenticated user (the routes only require "Auth.is_auth(config, req, { anyResources: true })", i.e. any token, not an admin) can therefore make the CloudTAK server issue arbitrary outbound GET/POST requests to internal addresses such as the cloud instance-metadata service ("169.254.169.254"), loopback admin ports ("127.0.0.1:<port>"), and other hosts reachable only from inside the deployment VPC. This is a full-read SSRF, not blind: on success the upstream JSON body is returned to the caller via "res.json(...)", and on failure the upstream error string is reflected verbatim as "ESRI Server Error: <message>". An attacker can read cloud metadata (and the temporary IAM credentials the instance role exposes), enumerate internal services, and exfiltrate their response bodies. The "sniff()" URL classifier provides no protection: it only pattern-matches the pathname ("/rest", "/arcgis/rest", "/sharing/rest"), so a URL like "http://169.254.169.254/arcgis/rest" or "http://127.0.0.1:8500/rest" passes "sniff()" and is fetched.