CVE-2026-59101 Details
Description
AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.
A server-side request forgery (SSRF) vulnerability has been identified in AutoBangumi versions prior to 3.2.8. This vulnerability allows unauthenticated remote attackers to probe internal network services by sending arbitrary host values to an unprotected setup endpoint. During the initial setup window, attackers can exploit this by sending requests to the POST /api/v1/setup/test-downloader endpoint. This causes the server to issue HTTP GET requests to internal or reserved addresses, leaking information through connection-error messages.
Users are advised to update AutoBangumi to version 3.2.8 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73 | [email protected] | Source CodeVendor |
| https://github.com/EstrellaXD/Auto_Bangumi/issues/1041 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/autobangumi-ssrf-via-api-v1-setup-test-downloader | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AutoBangumi | < 3.2.8 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |