CVE-2026-5538
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
QingdaoU OnlineJudge up to version 1.6.1 has a Server-Side Request Forgery (SSRF) vulnerability in the service_url function of JudgeServer.service_url in the judge_server_heartbeat endpoint. Manipulation of this parameter allows SSRF attacks.
Risk Assessment
An attacker can send requests to internal network resources, potentially leading to disclosure of sensitive data or further system compromise.
Recommendation
It is recommended to update QingdaoU OnlineJudge to the latest available version or apply appropriate security patches.
Original NVD description (English source)
A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.