---
id: CVE-2026-110610
title: >-
  ruoyi-vue-pro through 2026.09 contains a server-side request forgery
  vulnerability in the yudao-module-ai image service that allows authenticated
  users to make the server fetch arbitrary URLs by supplying referImageUrl to
  the midjourney …
summary: >-
  ruoyi-vue-pro through 2026.09 contains a server-side request forgery
  vulnerability in the yudao-module-ai image service that allows authenticated
  users to make the server fetch arbitrary URLs by supplying referImageUrl to
  the midjourney …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-918
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T15:17:13.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110610'
references:
  - url: >-
      https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/controller/admin/image/AiImageController.java#L97-L102
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/service/image/AiImageServiceImpl.java#L231
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yudao-ai-image-midjourney-ssrf'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ruoyi-vue-pro-through-2026.09-ssrf-via-midjourney-referimageurl-and-notify-imageurl
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.005Z'
---

## Overview

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.