CVE-2026-97326

Deferred Deferred - Pending Action

Server-Side Request Forgery in songxinjianqwe Chat

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-97326

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in the songxinjianqwe Chat application up to a specific commit hash. It allows remote attackers to manipulate the application to make unauthorized requests to internal systems by exploiting a weakness in the chat-server component's file ChatServer.java. The exploit is publicly available and the vendor did not respond to the disclosure.

Detection Guidance

The provided CVE data does not include specific detection methods or commands. The vulnerability involves server-side request forgery in a Java-based chat server component. Manual code review of chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java may be required to identify vulnerable request handling logic.

Impact Analysis

An attacker could use this SSRF vulnerability to send crafted requests from your server to internal or external systems, potentially accessing sensitive data, interacting with internal services, or bypassing network restrictions. This could lead to data breaches, unauthorized actions, or further network compromise depending on the server's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using this software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediate steps include updating the affected component to the latest version if available, implementing network-level restrictions to block malicious requests, and reviewing server-side request handling code for proper validation. Since the vendor did not respond, consider isolating the component or applying compensating controls.

Hi! I’m here to help you understand CVE-2026-97326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70