CVE-2026-59101

MediumCVSS 5.8

Published: 02/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

AutoBangumi before version 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

Risk Assessment

The risk involves unauthorized access to internal network resources, which could lead to information disclosure about the infrastructure and potential further attacks on internal services.

Recommendation

It is recommended to immediately upgrade AutoBangumi to version 3.2.8 or later, which fixes this vulnerability. Additionally, restrict access to the setup endpoint to trusted networks only.

Other vulnerabilities in AutoBangumi

CVE-2026-58466Critical
AutoBangumi before version 3.2.8 contains hard-coded default credentials that allow unauthenticated attackers to authenticate as the administrator using publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty.

Original NVD description (English source)

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS