CVE-2026-59101 is a server-side request forgery vulnerability in EstrellaXD's Auto_Bangumi product affecting versions before 3.2.8. Unauthenticated attackers can exploit an unprotected setup endpoint by supplying arbitrary host values to the POST /api/v1/setup/test-downloader endpoint during the initial setup window. This causes the server to issue HTTP GET requests to internal or reserved network addresses, potentially leaking information through error message responses. The vulnerability does not require user interaction or privileges and has a CVSS 3.1 base score of 5.8 (medium severity). No official remediation level or patch information is provided in the available data.

Exploitation of this SSRF vulnerability allows unauthenticated remote attackers to probe internal network services behind the server by inducing it to make HTTP requests to arbitrary internal or reserved IP addresses. This can lead to information disclosure via connection-error messages. The vulnerability does not directly impact integrity or availability but can reveal sensitive internal network details to attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict access to the initial setup endpoint and limit exposure of the server to untrusted networks during the setup window to reduce risk.