curl target or remote file_get_contents URL is built from a variable, enabling SSRF.
Validate and allowlist destination hosts; reject internal/link-local addresses.