CVE-2026-59101 is a server-side request forgery vulnerability in EstrellaXD Auto_Bangumi before version 3.2.8. Unauthenticated attackers can exploit the unprotected POST /api/v1/setup/test-downloader endpoint during the initial setup phase by supplying arbitrary host values. This causes the server to issue HTTP GET requests to internal network services or reserved IP addresses. The server's response includes echoed connection-error messages, which may leak information about internal network services. The vulnerability has a CVSS 3.1 base score of 5.8, indicating medium severity. No official patch or remediation level has been confirmed in the provided data.

The vulnerability allows unauthenticated remote attackers to probe internal network services by inducing the server to make HTTP requests to arbitrary internal or reserved addresses. This can lead to information disclosure through error messages, potentially aiding further attacks or reconnaissance. There is no indication of direct compromise, integrity loss, or denial of service from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the initial setup endpoint and monitor for unauthorized requests. Network-level controls to limit server outbound requests to trusted destinations may reduce risk. Avoid exposing the setup interface to untrusted networks during initial configuration.