Description
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."
Published: 2026-09-24
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery
Action: Apply Fix
AI Analysis

Impact

A flaw in ruoyi‑vue‑pro’s AI Knowledge Module allows remote attackers to pass a manipulated URL to AiKnowledgeDocumentServiceImpl.readUrl, causing server‑side request forgery (SSRF). The server then fetches the specified URL without proper validation, enabling access to arbitrary resources, which could disclose internal endpoints or external data. The exploit has been published and may be used, and the vendor has stated it will not release a code change to alter this behavior.

Affected Systems

The vulnerability impacts YunaiV and zhijiantianya releases of ruoyi‑vue‑pro through version 2026.08. The specific component affected is the AiKnowledgeDocumentServiceImpl.readUrl function within the AI Knowledge Module.

Risk and Exploitability

The CVSS score is 5.3 and the EPSS score is < 1%; the issue is not listed in the CISA KEV catalog. The exploit is publicly documented and can be carried out remotely. Based on the description, it is inferred that the attack vector involves sending a crafted request containing a malicious URL to the vulnerable endpoint, which the server then processes without proper validation. The risk is moderate but the presence of a published exploit increases the likelihood of real‑world attacks.

Generated by OpenCVE AI on October 29, 2026 at 07:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to a ruoyi‑vue‑pro version that addresses the SSRF in AiKnowledgeDocumentServiceImpl.readUrl as soon as it is released.
  • Restrict outbound HTTP requests from the AI Knowledge Module to a whitelist of trusted domains to prevent unauthorized internal network access.
  • Deploy a Web Application Firewall or proxy to block unexpected outbound traffic from the application and monitor logs for suspicious requests.

Generated by OpenCVE AI on October 29, 2026 at 07:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."
References

Fri, 25 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery
First Time appeared Yunaiv
Yunaiv ruoyi-vue-pro
Zhijiantianya
Zhijiantianya ruoyi-vue-pro
Weaknesses CWE-918
CPEs cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*
cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*
Vendors & Products Yunaiv
Yunaiv ruoyi-vue-pro
Zhijiantianya
Zhijiantianya ruoyi-vue-pro
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Yunaiv Ruoyi-vue-pro
Zhijiantianya Ruoyi-vue-pro
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-29T06:31:30.524Z

Reserved: 2026-09-24T11:34:08.225Z

Link: CVE-2026-97320

cve-icon Vulnrichment

Updated: 2026-09-25T14:04:44.476Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T19:17:21.247

Modified: 2026-10-29T07:16:45.180

Link: CVE-2026-97320

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T07:45:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)