PT-2026-30409 · Qingdaou · Onlinejudge

Ana10Gy · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5538

Mitre

CVSS v3.1

6.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service url of the file JudgeServer.service url of the component judge server heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-5538

Affected Products

Onlinejudge

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5538 · Security Note
• https://vuldb.com/submit/782203 · Note
• https://vuldb.com/vuln/355291 · Note
• https://vuldb.com/vuln/355291/cti · Note
• https://twitter.com/cyberbivash/status/2040667520672108634 · Twitter Post
• https://github.com/AnalogyC0de/public_exp/issues/27 · Note