The server fetches any user-supplied URL without validation, allowing SSRF attacks.
The server validates and restricts URLs to prevent SSRF attacks.