CVE-2026-110610Published
ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110610 · Microsoft / collected KEV context
cve-program · CVE-2026-110610
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yudao-ai-image-midjourney-ssrf
- https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/service/image/AiImageServiceImpl.java#L231
- https://github.com/YunaiV/ruoyi-vue-pro/blob/1697112f1164b206aeb031493980f5cb3a6e2cd5/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/controller/admin/image/AiImageController.java#L97-L102
- https://www.vulncheck.com/advisories/ruoyi-vue-pro-through-2026.09-ssrf-via-midjourney-referimageurl-and-notify-imageurl
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.