A web-accessible backdoor with resultant SSRF exists in Tp-shop 2.0.5 through 2.0.8 which allows remote attackers to obtain sensitive information attack intranet hosts or possibly trigger remote command execution because /vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php writes data from the \down_url\ URL into the \bddlj\ local file if the attacker knows the backdoor \jmmy\ parameter.