CVE-2026-97320 YunaiV/zhijiantianya CVE debrief

Who should care

Defenders responsible for systems using the ruoyi-vue-pro application, especially those with publicly accessible AI Knowledge Module functionality, should assess their exposure and prioritize verification of affected systems.

Why it matters

CVE-2026-97320 is a server-side request forgery vulnerability in the AI Knowledge Module of ruoyi-vue-pro. Defenders should assess exposure, prioritize verification, and consider implementing additional security measures.

• Potential unauthorized requests to internal resources
• Possible data breaches or system compromise
• Need for input validation and URL filtering
• Verification of affected system inventory and exposure

Technical summary

The AiKnowledgeDocumentServiceImpl.readUrl function in the AI Knowledge Module of ruoyi-vue-pro is vulnerable to server-side request forgery (SSRF). This occurs because the function does not properly validate or restrict the URL argument, allowing remote attackers to manipulate it and potentially make unauthorized requests to internal resources. The vulnerability has a CVSS score of 2.1 and is considered LOW severity. The exploit has been published, and defenders should assess their exposure, prioritize verification of affected systems, and consider implementing additional security measures such as input validation and URL filtering.

Defensive priority

Assess exposure and prioritize verification of affected systems, especially those with publicly accessible AI Knowledge Module functionality.

Recommended defensive actions

• Verify if the AI Knowledge Module is exposed to untrusted networks or users.
• Review and restrict access to the AiKnowledgeDocumentServiceImpl.readUrl function.
• Monitor for potential unauthorized requests to internal resources.
• Consider implementing additional security measures, such as input validation and URL filtering.
• Assess exposure and prioritize verification of affected systems, especially those with publicly accessible AI Knowledge Module functionality.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 2.1 and severity of LOW. The exploit has been published, but there is no information on in-the-wild exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.