Description
A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glowxq | glowxq-oj | 6f7c723090472057252040fd2bbbdaa1b5ed2393 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dovecot24 | 2.4.5-1.1 | openSUSE-SU-2026:11629-1 |
Advisories 2
- WID-SEC-2026-3076 Dovecot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- openSUSE-SU-2026:11629-1 dovecot24-2.4.5-1.1 on GA media SUSE / openSUSE Security Updates · Aug 29, 2026
References
- VDB-351112 | glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery vdb-entry technical-description
- VDB-351112 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #770476 | glowxq glowxq-oj 1.0.0 Server-Side Request Forgery third-party-advisory
- https://fx4tqqfvdw4.feishu.cn/docx/K0SjdZTPRo31LExSdlfcC3jwn1c?from=from_copylink exploit