Server-Side Request Forgery Vulnerability in Ruoyi-Vue-Pro Image Service

CVE-2026-110610

What is CVE-2026-110610?

The Ruoyi-Vue-Pro version through 2026.09 contains a server-side request forgery vulnerability in its yudao-module-ai image service. This flaw permits authenticated users to manipulate the server into fetching arbitrary URLs by supplying crafted inputs to the midjourney imagine endpoint. Specifically, attackers could exploit this vulnerability to make requests to internal HTTP services, including loopback addresses and private cloud metadata endpoints, potentially leading to unauthorized access and information leakage.

References