Home

Description

A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 1.3.3-beta is able to resolve this issue. This patch is called aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is advised. The project was informed beforehand and acted very professional: "We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols."

PUBLISHED Reserved 2026-02-25 | Published 2026-02-25 | Updated 2026-02-25 | Assigner VulDB




LOW: 2.3CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
LOW: 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
LOW: 3.1CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
2.1AV:N/AC:H/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C

Problem types

Server-Side Request Forgery

Product status

1.3.2-beta
affected

1.3.3-beta
unaffected

Timeline

2026-02-25:Advisory disclosed
2026-02-25:VulDB entry created
2026-02-25:VulDB entry last update

Credits

yuccun (VulDB User) reporter

References

vuldb.com/?id.347747 (VDB-347747 | feiyuchuixue sz-boot-parent download server-side request forgery) vdb-entry technical-description

vuldb.com/?ctiid.347747 (VDB-347747 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.754042 (Submit #754042 | feiyuchuixue https://github.com/feiyuchuixue/sz-boot-parent sz-boot-parent <= v1.3.2-beta Arbitrary_File_Read/SSRF) third-party-advisory

github.com/...sz-boot-parent-SSRF_and_Arbitrary_File_Read.md related

github.com/...ommit/aefaabfd7527188bfba3c8c9eee17c316d094802 patch

github.com/...huixue/sz-boot-parent/releases/tag/v1.3.3-beta patch

github.com/feiyuchuixue/sz-boot-parent/ product

cve.org (CVE-2026-3189)

nvd.nist.gov (CVE-2026-3189)

Download JSON