CVE-2026-75332: n/a

CVE-2026-75332 identifies a Server-Side Request Forgery (SSRF) vulnerability in Zyplayer-Doc versions up to 1.0.0. The flaw exists in the WikiPageWebService.download() method, which can be exploited by an attacker to make the server perform arbitrary HTTP requests. The vulnerability is classified under CWE-918 and has a CVSS v3.1 base score of 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker to access or interact with internal or protected resources that are otherwise inaccessible, potentially leading to data disclosure or manipulation. The vulnerability impacts confidentiality and integrity but does not affect availability. Given the critical CVSS score, the impact is considered severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing network-level protections such as restricting outbound requests from the affected service and monitoring for unusual request patterns related to WikiPageWebService.download().