CVE-2026-97320mediumCWE-918

CVE-2026-97320: fallo de gravedad media en YunaiV ruoyi-vue-pro

YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ruoyi-vue-pro+ Monitorear ruoyi-vue-pro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
YunaiV · ruoyi-vue-prozhijiantianya · ruoyi-vue-pro
CVEs relacionadas — YunaiV ruoyi-vue-pro

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2742MEDIUMzhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversalEPSS 0.9%CVE-2025-2743MEDIUMzhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversalEPSS 0.9%CVE-2026-116006MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authenticationEPSS 0.8%CVE-2025-2744MEDIUMzhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversalEPSS 0.7%CVE-2025-2708MEDIUMzhijiantianya ruoyi-vue-pro Backend File Upload upload path traversalEPSS 0.7%CVE-2025-2707MEDIUMzhijiantianya ruoyi-vue-pro Front-End Store upload path traversalEPSS 0.7%