AutoBangumi versions before 3.2.8 contain a server‑side request forgery flaw that allows unauthenticated attackers to specify arbitrary host values when the application is in its initial setup mode. The unprotected POST /api/v1/setup/test-downloader endpoint forwards these values as outbound HTTP GET requests to internal or reserved addresses and returns connection‑error messages, leaking information about the internal network configuration. The weakness is classified as CWE‑918, reflecting a lack of validation for outbound requests derived from user input.

Prior to version 3.2.8, all installations of EstrellaXD Auto_Bangumi are affected. No other product variants are listed, so the vulnerability applies to the entire Auto_Bangumi line older than the 3.2.8 release.

The vulnerability carries a CVSS score of 6.9, indicating moderate risk. The EPSS score is less than 1% of exploitation. Because the endpoint is unauthenticated during the setup period, an attacker can trigger the SSRF simply by sending a POST request; the server then follows the supplied URLs, potentially mapping internal services and gathering network topology data that could aid a subsequent attack.