CVE-2026-110610
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the ser…
Published Oct 14, 2026 · updated Oct 14, 2026
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP servic
Oct 14, 2026 · NIST NVD
Updated
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP servic
Sources
- CVE.orgCVE-2026-110610
Official CVE identifier
cve.org - NIST NVDCVE-2026-110610
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutoo
nvd.nist.gov