What’s Vulnerable › Vulnerabilities

CVE-2026-59101: AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-02 · updated 2026-10-25
• Weakness: CWE-918

Description

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

Affected products

• EstrellaXD Auto_Bangumi: before 3.2.8 — fixed in 3.2.8

How to fix

Upgrade to a fixed version: EstrellaXD Auto_Bangumi 3.2.8. Check the vendor advisory for mitigations.

References

• https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73
• https://github.com/EstrellaXD/Auto_Bangumi/issues/1041
• https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8
• https://www.vulncheck.com/advisories/autobangumi-ssrf-via-api-v1-setup-test-downloader

Get alerted when CVE-2026-59101 or the next vulnerability affects your stack