EUVD-2026-39521
GHSA-wg7f-c2g2-5gwm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required workspace account; S:C and C:H because internal service responses are exfiltrated; I:L for credential replay; A:N as no availability impact is described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Huly Platform before commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.
AnalysisAI
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front pod into making arbitrary HTTP requests to internal infrastructure. Any valid workspace account can supply attacker-controlled URLs; the server fetches them, leaking internal service responses - including cloud metadata credentials - back to the attacker. A publicly available exploit exists per the GitHub issue tracker, though active exploitation has not been confirmed by CISA KEV. The CVSS 4.0 vector assigns SC:H, flagging high confidentiality impact on subsequent (internal) systems as the primary risk.
Technical ContextAI
Huly Platform (CPE: cpe:2.3:a:hcengineering:platform:*:*:*:*:*:*:*:*) is an open-source project management application whose front pod exposes a /import HTTP endpoint. This endpoint accepted user-supplied URLs and performed server-side fetches without sanitizing the target against private IP ranges, loopback addresses, cloud metadata endpoints, or disallowed URI schemes - a textbook CWE-918 (Server-Side Request Forgery) root cause. The fix introduced in PR #10910 (commit 68cbf8a) adds a validateFetchUrl function that blocks localhost, 127.x, 10.x, 172.16-31.x, 192.168.x, 169.254.x (link-local/metadata), ::1, fc00::/7, fe80::/10, IPv6-mapped IPv4 addresses, NAT64 prefixes, CGNAT (100.64/10), multicast, and reserved ranges - covering the full gamut of internal address space exploitable via SSRF.
RemediationAI
Update Huly Platform to a build incorporating commit 68cbf8a or any subsequent commit from the main branch. The fix adds comprehensive SSRF protection via a validateFetchUrl utility that rejects private, loopback, link-local, CGNAT, multicast, and reserved IP ranges for both IPv4 and IPv6, as well as non-HTTP/HTTPS protocols. See the patch at https://github.com/hcengineering/platform/commit/68cbf8a88642d8313f151a274fb5c24dee6a2762. If immediate upgrade is not feasible, restrict outbound network access from the front pod at the firewall or container network policy level - block egress to 169.254.169.254 (cloud metadata), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and ::1/fc00::/7 ranges. This reduces SSRF reach at the cost of potentially breaking intended integrations that fetch external resources via the /import endpoint. Disable the /import endpoint entirely if it is not operationally required, though this may impact import functionality.
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does n
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today