CVE-2026-61840

Name of the Vulnerable Software and Affected Versions Quest Bot versions prior to 1.1.9

Description The image to GIF command uses a request helper that validates a hostname's public IP addresses but subsequently sends the request by hostname, resulting in a second DNS lookup. This allows an attacker controlling a domain to bypass internal-address protection via DNS rebinding (a technique where a domain name resolves to different IP addresses during successive DNS queries) by returning a public address during validation and an internal address during the connection. The command accepts addresses directly from user input and is accessible to any server member. Requests are limited to HTTPS on port 443 and only return content if the response is a genuine image, limiting the impact to blind internal probing and limited retrieval of image responses from loopback or internal endpoints.

Recommendations Update to version 1.1.9.