CVE-2026-110610

Deferred Deferred - Pending Action

Server-Side Request Forgery in RuoYi-Vue-Pro Image Service

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110610

EUVD

EUVD-2026-101238

Affected Vendors & Products

Vendor	Product	Version / Range
YunaiV	ruoyi-vue-pro	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-110610 is a Server-Side Request Forgery (SSRF) vulnerability in ruoyi-vue-pro through version 2026.09. It affects the yudao-module-ai image service, specifically the Midjourney imagine endpoint. Authenticated users can manipulate the server into fetching arbitrary URLs by supplying a referImageUrl parameter. The vulnerability stems from the Hutool HttpUtil.downloadBytes() function, which lacks host validation and allows requests to loopback, private, or cloud metadata addresses.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for outbound requests from the ruoyi-vue-pro server to unexpected destinations like loopback addresses (127.0.0.1), private IPs, or cloud metadata endpoints. Check logs for requests to /ai/image/midjourney/imagine or /ai/image/midjourney/notify with suspicious referImageUrl or imageUrl parameters. Use tools like tcpdump or Wireshark to capture unusual HTTP requests originating from the application server.

Impact Analysis

This SSRF vulnerability allows attackers to probe internal-only HTTP services, access sensitive metadata endpoints, and potentially retrieve partial responses stored as files. It enables internal service enumeration and could lead to unauthorized access to internal resources if network egress rules permit such requests.

Compliance Impact

This SSRF vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to internal services and metadata endpoints. Attackers could probe private networks or cloud metadata addresses, potentially exposing sensitive data or internal system information. The lack of input validation in URL fetching may lead to unauthorized data exfiltration or internal service probing, which are direct violations of data protection requirements under these regulations.

Mitigation Strategies

Immediately update ruoyi-vue-pro to a patched version beyond 2026.09. If unavailable, restrict access to the vulnerable endpoints by removing or disabling the Midjourney image service features. Implement strict input validation for referImageUrl and imageUrl parameters to block loopback, private, and metadata addresses. Add host allowlists for outbound HTTP requests from the application server.

Hi! I’m here to help you understand CVE-2026-110610. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70