EUVD-2026-39660
GHSA-fpm8-6xjp-2hq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Clear
Full administrative credentials required to reach the RSS import feature; only limited confidentiality impact (partial file or network data disclosure) with no integrity or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com/ , file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.
AnalysisAI
Server-Side Request Forgery in HTMLy 3.1.1 allows authenticated administrators to coerce the server into issuing arbitrary outbound HTTP or local filesystem requests via the RSS feed import feature. The vulnerable get_feed() function at system/admin/admin.php lines 1549-1551 passes the admin-supplied URL directly to PHP's file_get_contents() with no scheme filtering or allowlist validation, enabling access to cloud metadata endpoints (e.g., 169.254.169.254), internal network services, or local files via file:// wrappers. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the high privilege prerequisite and limited confidentiality impact.
Technical ContextAI
HTMLy is a PHP flat-file blogging CMS developed by danpros (CPE: cpe:2.3:a:danpros:htmly:*:*:*:*:*:*:*:*). The root cause maps to CWE-918 (Server-Side Request Forgery): the get_feed() function unconditionally invokes PHP's file_get_contents($feed_url) where $feed_url is the raw, unvalidated value submitted by the admin user. PHP's file_get_contents() honors multiple URL stream wrappers - including http://, https://, file://, and ftp:// - when allow_url_fopen is enabled (the PHP default), making this a multi-protocol SSRF risk. The code path is directly reachable through the admin UI at Tools → Import RSS, with no intermediate sanitization layer. The referenced commit (c8b7ed9) confirms the vulnerable lines exist in the current codebase.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the sole reference points to the vulnerable source code rather than a fix. Monitor the HTMLy GitHub repository (https://github.com/danpros/htmly) for upstream patches and apply them when available. As compensating controls: restrict admin panel access to trusted IP ranges or a VPN, eliminating network exposure to untrusted parties (most effective mitigation, no functional trade-off for most deployments); apply egress firewall rules on the web server host to block outbound connections to cloud metadata IP ranges (169.254.169.254, fd00:ec2::254) and RFC-1918 internal ranges, preventing the most impactful pivot scenarios; set allow_url_fopen = Off in php.ini to disable URL-based stream wrappers in file_get_contents(), though this may break other PHP functionality relying on remote URL fetching and should be tested before deployment; and enable IMDSv2 enforcement on cloud instances (AWS hop-limit = 1, Azure IMDS equivalent) to neutralize the metadata endpoint attack path specifically.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today