CVE-2026-59101

Description

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

References

https://www.vulncheck.com/advisories/autobangumi-ssrf-via-api-v1-setup-test-downloader

https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8

https://github.com/EstrellaXD/Auto_Bangumi/issues/1041

https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4