Description
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor explains: "[W]e have reviewed the AI knowledge URL fetching report and decided not to schedule a code change for this behavior. The existing behavior is retained."
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
YunaiV ruoyi-vue-pro
2026.08affected
zhijiantianya ruoyi-vue-pro
2026.08affected
References
- https://vuldb.com/vuln/409328 ↗
- https://vuldb.com/vuln/409328/cti ↗
- https://vuldb.com/cve/CVE-2026-97320 ↗
- https://vuldb.com/submit/908270 ↗
- https://github.com/YunaiV/ruoyi-vue-pro/issues/1176 ↗
- https://github.com/YunaiV/ruoyi-vue-pro/issues/1176#issuecomment-6442824858 ↗
- https://github.com/YunaiV/ruoyi-vue-pro/ ↗