Description
A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/PPTUtil.java of the component PPT File Handler. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-16
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server-side request forgery
Action: Patch ASAP
AI Analysis

Impact

An SSRF vulnerability exists in the downloadFile function of the PPTUtil.java component of Taoofagi easegen-admin. The flaw allows an attacker to supply a crafted URL, causing the server to perform a request to an arbitrary internal or external address. This can lead to unauthorized data access, internal network reconnaissance, or further exploitation. The weakness is identified as CWE-918.

Affected Systems

All instances of Taoofagi easegen-admin up to commit 8f87936ac774065b92fb20aab55b274a6ea76433 are affected. No specific release numbers are provided because the project uses a rolling release model.

Risk and Exploitability

The CVSS base score of 5.1 denotes moderate severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely over the network, requiring only the ability to craft a request to the application. The lack of an official patch or publicly documented workaround increases the risk until the vendor releases a fix.

Generated by OpenCVE AI on March 17, 2026 at 00:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply vendor patch if available.
  • If no patch, restrict outbound network connections from the affected servers.
  • Monitor application logs for unusual outbound requests.
  • If urgent, contact vendor to obtain a temporary remediation.

Generated by OpenCVE AI on March 17, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 17 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Taoofagi
Taoofagi easegen-admin
Vendors & Products Taoofagi
Taoofagi easegen-admin

Mon, 16 Mar 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/PPTUtil.java of the component PPT File Handler. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Title taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Taoofagi Easegen-admin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-17T13:34:53.412Z

Reserved: 2026-03-16T16:26:03.909Z

Link: CVE-2026-4284

cve-icon Vulnrichment

Updated: 2026-03-17T13:34:47.916Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-16T23:16:21.703

Modified: 2026-03-17T14:20:01.670

Link: CVE-2026-4284

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-24T10:49:43Z

Weaknesses