CVE-2026-4200 glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery
Remote attackers can exploit a server-side request forgery flaw in the glowxq-oj online judge system to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4200?
CVE-2026-4200 is a medium-severity server-side request forgery vulnerability in glowxq-oj, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-918
Which versions are affected by CVE-2026-4200?
How do I fix CVE-2026-4200?
No fix published yet.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-4200 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4200 exists.
Sources
Also known as GHSA-8975-rxwf-wq3j.