OX App Suite up to and including 7.10.3 allows SSRF via the the /ajax/messaging/message message API.
open-xchange open-xchange appsuite