Login Request a demo
Medium severity · published Oct 14, 2026
CVE-2026-110610
ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
ruoyi-vue-pro · YunaiV
through 2026.09 · source: vendor
Affected product
RU
ruoyi-vue-pro
YunaiV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110610
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110610
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yudao-ai-image-midjourney-ssrf
technical-description
https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/service/image/AiImageServiceImpl.java#L231
technical-description
https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/controller/admin/image/AiImageController.java#L97-L102
third-party-advisory
https://www.vulncheck.com/advisories/ruoyi-vue-pro-through-2026.09-ssrf-via-midjourney-referimageurl-and-notify-imageurl
More from ruoyi-vue-pro
8.8
CVE-2025-10988
YunaiV ruoyi-vue-pro transfer improper authorization
8.8
CVE-2025-10278
YunaiV ruoyi-vue-pro transfer improper authorization
8.8
CVE-2025-10276
YunaiV ruoyi-vue-pro transfer improper authorization
7.3
CVE-2026-116006
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
7.3
CVE-2026-97324
YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization