PT-2026-24890 · Zyddnys · Manga-Image-Translator

Zast.Ai · Published 2026-03-11 · Updated 2026-03-12 · CVE-2026-3961

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zyddnys manga-image-translator versions through beta-0.3

Description A server-side request forgery condition exists in zyddnys manga-image-translator. The issue is located in the to pil image function within the request extraction.py file of the Translate Endpoints component. This manipulation can lead to server-side request forgery, and the attack can be initiated remotely. The exploit has been publicly disclosed. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to beta-0.3 should be used. As a temporary workaround, consider restricting access to the to pil image() function until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3961

Affected Products

Manga-Image-Translator

References · 16

• 🔥 https://github.com/zyddnys/manga-image-translator/issues/1119 · Exploit
• https://osv.dev/vulnerability/CVE-2026-3961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3961 · Security Note
• https://github.com/zyddnys/manga-image-translator/issues/1118 · Note
• https://vuldb.com/?submit.768180 · Note
• https://vuldb.com/?submit.768214 · Note
• https://vuldb.com/?submit.768225 · Note
• https://vuldb.com/?submit.768210 · Note
• https://vuldb.com/?submit.768212 · Note
• https://vuldb.com/?id.350390 · Note
• https://vuldb.com/?submit.768224 · Note
• https://vuldb.com/?submit.768211 · Note
• https://github.com/zyddnys/manga-image-translator · Note
• https://t.me/CVEtracker/47197 · Telegram Post
• https://vuldb.com/?ctiid.350390 · Note