PT-2026-24890 · Zyddnys · Manga-Image-Translator

Zast.Ai · Publicado 2026-03-11 · Atualizado 2026-03-12 · CVE-2026-3961

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zyddnys manga-image-translator versions through beta-0.3

Description A server-side request forgery condition exists in zyddnys manga-image-translator. The issue is located in the to pil image function within the request extraction.py file of the Translate Endpoints component. This manipulation can lead to server-side request forgery, and the attack can be initiated remotely. The exploit has been publicly disclosed. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to beta-0.3 should be used. As a temporary workaround, consider restricting access to the to pil image() function until a patch is available.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-3961

Produtos afetados

Manga-Image-Translator

Referências · 16

• 🔥 https://github.com/zyddnys/manga-image-translator/issues/1119 · Exploit
• https://github.com/zyddnys/manga-image-translator/issues/1118 · Nota
• https://osv.dev/vulnerability/CVE-2026-3961 · Aviso do Fabricante
• https://vuldb.com/?submit.768180 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3961 · Nota de Segurança
• https://vuldb.com/?submit.768214 · Nota
• https://vuldb.com/?submit.768225 · Nota
• https://vuldb.com/?submit.768210 · Nota
• https://vuldb.com/?submit.768212 · Nota
• https://vuldb.com/?id.350390 · Nota
• https://vuldb.com/?submit.768224 · Nota
• https://vuldb.com/?submit.768211 · Nota
• https://github.com/zyddnys/manga-image-translator · Nota
• https://t.me/CVEtracker/47197 · Publicação no Telegram
• https://vuldb.com/?ctiid.350390 · Nota