PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110610 YunaiV CVE debrief

CVE-2026-110610 is a server-side request forgery vulnerability in ruoyi-vue-pro through 2026.09. Authenticated users can make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint, potentially probing internal-only HTTP services and reaching metadata endpoints. The vulnerability allows attackers to force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses. Defenders responsible for systems using ruoyi-vue-pro through 2026.09, especially those with internet-facing midjourney imagine endpoints, should assess exposure and prioritize verification and remediation.

Vendor
YunaiV
Product
ruoyi-vue-pro
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for systems using ruoyi-vue-pro through 2026.09, especially those with internet-facing midjourney imagine endpoints, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-110610 is a server-side request forgery vulnerability in ruoyi-vue-pro through 2026.09 that allows authenticated users to make the server fetch arbitrary URLs, potentially probing internal-only HTTP services and reaching metadata endpoints. Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, especially for systems with internet-facing midjourney imagine endpoints.

  • Potential probing of internal-only HTTP services
  • Potential reaching of metadata endpoints
  • Need for verification of vulnerability in inventory
  • Need for assessment of exposure and potential impact

Technical summary

The vulnerability is caused by a lack of proper validation and sanitization of user-supplied input in the midjourney imagine endpoint. An authenticated user can supply a malicious referImageUrl parameter to the endpoint, which can then be used to make the server fetch arbitrary URLs. This can lead to potential probing of internal-only HTTP services and reaching of metadata endpoints. The affected product, ruoyi-vue-pro, is vulnerable through version 2026.09. Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, especially for systems with internet-facing midjourney imagine endpoints.

Defensive priority

Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, especially for systems with internet-facing midjourney imagine endpoints.

Recommended defensive actions

  • Verify the vulnerability in your inventory and assess exposure, especially for systems with internet-facing midjourney imagine endpoints.
  • Restrict access to the midjourney imagine endpoint to only necessary users and services.
  • Implement additional security measures, such as IP blocking or rate limiting, to prevent abuse of the endpoint.
  • Monitor for suspicious activity and implement logging and alerting to detect potential exploitation attempts.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, additional information on exploitation, impact, and remediation is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110610 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110610

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110610 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110610

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110610.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yudao-ai-image-midjourney-ssrf

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/service/image/AiImageServiceImpl.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/controller/admin/image/AiImageController.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ruoyi-vue-pro-through-2026.09-ssrf-via-midjourney-referimageurl-and-notify-imageurl

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.