CVE-2026-97320

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-97320
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/YunaiV/ruoyi-vue-pro/
https://github.com/YunaiV/ruoyi-vue-pro/issues/1176
https://github.com/YunaiV/ruoyi-vue-pro/issues/1176#issuecomment-6442824858
https://vuldb.com/cve/CVE-2026-97320
https://vuldb.com/submit/908270
https://vuldb.com/vuln/409328
https://vuldb.com/vuln/409328/cti
https://vuldb.com/submit/908270
Configurations

No configuration.

History

29 Oct 2026, 07:16

Type Values Removed Values Added
Summary (en) A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."
References
  • () https://github.com/YunaiV/ruoyi-vue-pro/ -
  • () https://github.com/YunaiV/ruoyi-vue-pro/issues/1176 -
  • () https://github.com/YunaiV/ruoyi-vue-pro/issues/1176#issuecomment-6442824858 -

25 Sep 2026, 15:17

Type Values Removed Values Added
References () https://vuldb.com/submit/908270 - () https://vuldb.com/submit/908270 -

24 Sep 2026, 19:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-24 19:17

Updated : 2026-10-29 07:16

NVD link : CVE-2026-97320

Mitre link : CVE-2026-97320

CVE.ORG link : CVE-2026-97320

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)