Read the docs
TI-2026-64033 Aliases CVE-2026-97320GHSA-228m-p28v-qwvj

Server-side request forgery in YunaiV ruoyi-vue-pro

Priority MEDIUM 57CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YunaiVruoyi-vue-pro2026.08—No fix listedCNA
YunaiVruoyi-vue-pro2026.08—No fix listedCNA
  • ruoyi-vue-pro VendorYunaiV Affected 2026.08 Fixed in — No fix listed CNA
  • ruoyi-vue-pro VendorYunaiV Affected 2026.08 Fixed in — No fix listed CNA

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*———
cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:* Versions — — ·—
  • cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-97320
  2. 2026-10-03 Alias added: GHSA-228m-p28v-qwvj
  3. 2026-10-29 3 new references · CNA

References

Other 3

  • TI-2026-80126 Improper authentication in YunaiV ruoyi-vue-pro SMS code verification CVSS 4.0MEDIUM 6.9
  • TI-2026-11453 Path traversal in YunaiV ruoyi-vue-pro CVSS 4.0MEDIUM 6.9
  • TI-2026-06792 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-04492 YunaiV yudao-cloud get-by-website sql injection CVSS 4.0MEDIUM 6.9
  • TI-2026-80085 Authorization bypass in yudao-cloud lets users evade data scope CVSS 4.0HIGH 7.1
  • TI-2026-42058 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API CVSS 4.0HIGH 7.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences