Vulnerability · Published Jul 2, 2026 · Assigned by VulnCheck

CVE-2026-59101AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader

Medium 5.8

In plain English

A medium-severity server-side request forgery in Auto_Bangumi from EstrellaXD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

Affected products (as reported)

Vendor	Product	Versions
EstrellaXD	Auto_Bangumi	0 – before 3.2.8

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

Release Notes release-notes
GitHub Issue issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/autobangumi-ssrf-via-api-v1-setup-test-downloader third-party-advisory