CVE-2026-110610: ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The vulnerable path is in the yudao-module-ai image service, specifically the Midjourney imagine endpoint that accepts referImageUrl.
What network targets can an attacker reach through the vulnerable request?
The server can be induced to fetch arbitrary URLs, including loopback addresses, private-network HTTP services, and cloud metadata endpoints. This can allow probing of services that are not externally accessible.
Is user interaction required to exploit the vulnerability?
No. The supplied vector has network access, low attack complexity, low privileges required, and no user interaction requirement.
How can I determine whether my deployment is affected?
Deployments using ruoyi-vue-pro through 2026.09 are affected if the yudao-module-ai image service exposes the Midjourney imagine endpoint and processes user-controlled referImageUrl values with Hutool HttpUtil.downloadBytes().