CVE-2026-5346

EUVD-2026-18348 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-02 cna@vuldb.com

GHSA-395j-2jwf-q33h

SSRF

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 02, 2026 - 15:22 euvd

EUVD-2026-18348

Analysis Generated

Apr 02, 2026 - 15:22 vuln.today

CVE Published

Apr 02, 2026 - 15:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in huimeicloud hm_editor up to version 2.2.3 allows remote attackers to manipulate the url parameter in the image-to-base64 endpoint (client.get function in src/mcp-server.js), enabling arbitrary HTTP requests from the server. The vulnerability carries a CVSS 6.9 score and publicly available exploit code exists; the vendor has not responded to early disclosure attempts.

Technical ContextAI

The vulnerability exists in the image-to-base64 endpoint component of hm_editor's MCP server implementation. The client.get function in src/mcp-server.js fails to properly validate or sanitize the url parameter before using it in server-side HTTP requests, creating a classic Server-Side Request Forgery (SSRF) condition classified under CWE-918. This allows attackers to bypass network boundaries and access internal resources, services on the local network, or perform actions on behalf of the server. The root cause is insufficient input validation on user-controlled URL parameters that are directly passed to HTTP client libraries.

RemediationAI

Upgrade huimeicloud hm_editor to a version after 2.2.3 if a patched release is available; however, vendor-released patch information has not been confirmed from available data. Organizations unable to upgrade should implement network-level controls to restrict outbound HTTP/HTTPS requests from the hm_editor application server, enforce input validation rules that reject suspicious URL schemes (file://, gopher://, etc.) and internal IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and isolate the hm_editor service to a restricted network segment. Given the vendor's non-responsiveness, consider evaluating alternative solutions or forking the code if internal patches can be developed. Additional information may be available via https://vuldb.com/vuln/354701 and the referenced GitHub issue at https://github.com/wing3e/public_exp/issues/11.