PT-2026-25575 · Glowxq · Glowxq-Oj

Vuldb + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4200

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions glowxq glowxq-oj versions prior to 6f7c723090472057252040fd2bbbdaa1b5ed2393

Description A security issue exists in glowxq glowxq-oj. A manipulation of the uploadTestcaseZipUrl function in the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java can lead to server-side request forgery. This attack can be initiated remotely. The exploit is publicly available. The product uses continuous delivery with rolling releases, and no specific version details for affected or updated releases are available. The vendor was contacted regarding this issue but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4200

Affected Products

Glowxq-Oj

References · 6

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/K0SjdZTPRo31LExSdlfcC3jwn1c?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4200 · Security Note
• https://vuldb.com/?id.351112 · Note
• https://vuldb.com/?submit.770476 · Note
• https://t.me/CVEtracker/47474 · Telegram Post
• https://vuldb.com/?ctiid.351112 · Note