A vulnerability classified as critical was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery.
This vulnerability is handled as CVE-2026-3189. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
The project was informed beforehand and acted very professional: “We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols.”
