HTMLy CVE-2026-37107

Exploitation targets the get_feed function within the admin.php component of HTMLy v3.1.1 specifically, so the installation must be running exactly this release with the admin component reachable by the attacker. The supplied CVSS vector (PR:N/UI:N) implies no authentication or user interaction is needed, which would mean any network-reachable HTMLy 3.1.1 instance in default configuration is exposed; however, because the issue is categorized as privilege escalation (CWE-269), realistic exploitation may instead require an existing low-privileged account or session, and this prerequisite should be confirmed from the referenced POC before ruling it out. Limiting factors: the flaw is confined to HTMLy 3.1.1, the product's deployment footprint is small, and sites that keep the admin interface off the public internet substantially reduce exposure.

The input assigns a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying remote, unauthenticated, low-complexity compromise with full confidentiality, integrity and availability impact. However, this conflicts with the vulnerability class: CWE-269 (Improper Privilege Management) and the description's own wording - 'escalate privileges' - normally presuppose that the attacker already holds some lower-privileged foothold, which would argue for PR:L rather than PR:N. This PR discrepancy should be verified against the vendor/POC before treating the 9.8 as authoritative. No EPSS score and no CISA KEV entry were provided, so there is no evidence of active, widespread exploitation; absence of these signals is not proof of safety but does lower urgency relative to a KEV-listed flaw. A proof-of-concept gist (KyrieKlay) is referenced, so public exploit code appears to exist, which raises practical risk for exposed instances. Netting it out: this is a genuinely serious flaw in any internet-facing HTMLy 3.1.1 admin surface, but its real-world priority is tempered by HTMLy's small deployment footprint and the unresolved PR:N-vs-PR:L question - treat as high-priority for the niche population running HTMLy, not as a broad fleet-wide emergency.

An attacker reaches an internet-exposed HTMLy 3.1.1 site and sends a crafted request exercising the get_feed function in admin.php, abusing improper privilege management to gain administrative control of the blog. Public proof-of-concept code is referenced (a gist), lowering the skill barrier. Because the input CVSS marks the attack vector as network with low complexity and no user interaction, exploitation can be scripted against reachable instances, though whether a prior low-privileged session is required remains unconfirmed.