Unauthenticated SSRF via image_url in the API server, bypassing check_ssrf_url by redirect and DNS rebinding (incomplete fix)
Author: geo-chenCreated Jul 13, 2026Updated Sep 4, 2026
Labelsbugpending
Reminder
- I have read the above rules and searched the existing issues.
System Info
Reproduction
Hi, I've submitted a security report to https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-fcm9-7xcw-g9xp on 12 June 2026 - could a maintainer take a look pleasE? thanks.
Others
No response
Source: hiyouga/LlamaFactory