Skip to main content

HTMLy CVE-2026-57940

| EUVDEUVD-2026-39660 LOW
Server-Side Request Forgery (SSRF) (CWE-918)
2026-06-26 mitre GHSA-fpm8-6xjp-2hq8
SSRF PHP Htmly
2.1
CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Clear
vuln.today AI
2.7 LOW

Full administrative credentials required to reach the RSS import feature; only limited confidentiality impact (partial file or network data disclosure) with no integrity or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Clear
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 26, 2026 - 13:51 vuln.today

DescriptionCVE.org

HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com/ , file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.

AnalysisAI

Server-Side Request Forgery in HTMLy 3.1.1 allows authenticated administrators to coerce the server into issuing arbitrary outbound HTTP or local filesystem requests via the RSS feed import feature. The vulnerable get_feed() function at system/admin/admin.php lines 1549-1551 passes the admin-supplied URL directly to PHP's file_get_contents() with no scheme filtering or allowlist validation, enabling access to cloud metadata endpoints (e.g., 169.254.169.254), internal network services, or local files via file:// wrappers. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain or compromise HTMLy admin credentials
Delivery
Authenticate to HTMLy admin panel
Exploit
Navigate to Tools
Install
Import RSS
C2
Submit crafted URL (file:// or http://169.254.169.254)
Execute
Server calls file_get_contents() against target
Impact
Exfiltrate internal resource response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation strictly requires an authenticated session with administrative privileges in HTMLy (PR:H per CVSS vector); there is no unauthenticated or low-privilege path to the vulnerable `get_feed()` function. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is low despite the SSRF class of vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained HTMLy administrator credentials - through credential stuffing, phishing, or a prior compromise - navigates to the Tools → Import RSS page and submits `http://169.254.169.254/latest/meta-data/iam/security-credentials/` as the feed URL. The server issues the HTTP request and the attacker reads the cloud IAM role credentials from the response, enabling lateral movement within the cloud environment. …
Remediation No vendor-released patched version has been identified at time of analysis - the sole reference points to the vulnerable source code rather than a fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2023-48022 CRITICAL POC
9.8
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8
CVE-2026-15409 CRITICAL POC
10.0
CVE-2024-54385 HIGH POC
7.2
CVE-2022-45835 MEDIUM POC
5.8
CVE-2024-54330 HIGH POC
7.2
CVE-2026-20230 HIGH POC
8.6

Share

CVE-2026-57940 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy