SSRF → internal Redis → RCE via gopher://

When it applies

• You have a confirmed SSRF: the app fetches a URL you control (webhook, "import from URL", link preview, avatar-by-URL, headless PDF, XXE-to-SSRF), and it will follow gopher:// (curl-backed fetchers commonly do).
• An internal Redis is reachable from the app host (127.0.0.1:6379 or a Docker service) and is unauthenticated (default) or you know the password.

Why it works

Redis speaks a simple newline/inline text protocol. gopher:// lets you send arbitrary raw bytes to a TCP port, so you can pipeline real Redis commands through the SSRF. Redis can write files (CONFIG SET dir + dbfilename + SAVE), so you overwrite a file that gets executed: a cron job, ~/.ssh/authorized_keys, or a web-root PHP file.