The vulnerability allows an attacker to send a crafted HTTP request that the QD service will forward to any target defined by the attacker, enabling the internal network or external resources to be accessed or enumerated. This server‑side request forgery can expose sensitive data and internal services. The weakness is classified as CWE‑918, reflecting improper validation of outbound requests. The attacker could potentially retrieve information, compromise internal hosts, or assist in further attacks such as lateral movement.

The affected software is QD 20230821, a product of QD Today. The version is identified by the CPE string for QD, but no specific version range is supplied; therefore any installation of QD that includes the relevant component may be vulnerable.

The CVSS score of 9.1 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is currently infrequent, and the vulnerability is not listed in the CISA catalog of known exploited vulnerabilities. Attackers can trigger the flaw from external networks or internal actors with network access; the likely vector is remote exploitation via crafted requests as described.