AutoBangumi versions before 3.2.8 contain a server‑side request forgery flaw that allows unauthenticated attackers to specify arbitrary host values when the application is in its initial setup mode. The unprotected POST /api/v1/setup/test-downloader endpoint forwards these values as outbound HTTP GET requests to internal or reserved addresses and returns connection‑error messages, leaking information about the internal network configuration. The weakness is classified as CWE‑918, reflecting a lack of validation for outbound requests derived from user input.

Prior to version 3.2.8, all installations of EstrellaXD Auto_Bangumi are affected. No other product variants are listed, so the vulnerability applies to the entire Auto_Bangumi line older than the 3.2.8 release.

The vulnerability exhibits a CVSS score of 6.9, indicating a moderate severity. The EPSS score is less than 1%, suggesting. Because the POST /api/v the initial setup can trigger the SSRF simply by submitting a POST request; the server then forwards the supplied URL in an outbound HTTP GET request. The returned connection‑error messages can expose information about internal hosts or services. This behavior is inferred from the description that the server echoes connection‑error messages.