CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-51152

CVE-2026-51152 is a critical SSRF (CVSS 9.1) in QD (a HAR file processing tool by QD-Today), affecting versions 20220208 through 20250803 . The root cause is in Fetcher.build_request() in libs/fetcher.py, which constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL sc...

EUVD-2026-68648

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

PT-2026-83867

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build request in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication...