# CVE-2023-46945: QD-Today QD SSRF in OCR verification code function

Source: https://junglewise.ai/threats/cve-2023-46945-qd-today-qd-ssrf-in-ocr-verification-code-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2023-46945 · Severity: critical · CVSS 9.1 · Published 2026-04-08

QD, an open-source HTTP task automation framework, contains a security flaw in its image processing component. An attacker can trick the server into making unauthorized requests to internal or external systems by providing a malicious URL for a verification code image. This could allow an attacker to bypass firewalls, access sensitive internal data, or scan private corporate networks.

Technologies: [Qd-Today Qd](https://junglewise.ai/threats/technologies/qd). Vendors: [Qd-Today](https://junglewise.ai/threats/vendors/qd-today).

## Quick answers

**Is CVE-2023-46945 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-46945 being exploited in the wild.

**How severe is CVE-2023-46945?** Critical severity, with a CVSS score of 9.1, published 8 April 2026.

**Which products and versions are affected?** Qd-Today Qd 20220208 through 20230821.

**Is there a fix for CVE-2023-46945?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-46945 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-46945?** Check whether you run Qd-Today Qd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the QD HTTP task automation framework (versions 20220208 through 20230821). The vulnerability is located in the OCR (Optical Character Recognition) functionality, where the application fails to properly validate user-supplied URLs for verification code images. A remote, unauthenticated attacker can provide a crafted URL, causing the Tornado-based server to initiate outbound HTTP requests. This can be leveraged to access internal metadata services, scan internal network ports, or interact with other internal services that are not exposed to the public internet.

## Affected products

- QD-Today QD 20220208 through 20230821

## Timeline

- 2023-11-23: other: Researcher activity on Gist advisory
- 2026-04-08: disclosed: CVE published

## References

- [https://gist.github.com/kurokoleung/5b36b2013a54adadcce79967d3e4f056](https://gist.github.com/kurokoleung/5b36b2013a54adadcce79967d3e4f056)
- [https://qd-today.github.io/qd/](https://qd-today.github.io/qd/)