CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-51152

The software QD (versions 20220208 through 20250803) is vulnerable to a Server-side request forgery (SSRF) in the /har/test endpoint. The root cause is located in Fetcher.build_request() within libs/fetcher.py , which constructs an httpclient.HTTPRequest from user-supplied JSON without validating...

EUVD-2026-68648

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

PT-2026-83867

Name of the Vulnerable Software and Affected Versions QD versions 20220208 through 20250803 Description An unauthenticated remote attacker can perform a Server-side request forgery SSRF via the '/har/test' endpoint. The Fetcher.build request function in libs/fetcher.py creates an...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...