Huly Platform EUVD-2026-19174

The CVSS v3.1 score of 6.3 reflects a moderate severity baseline with network-exploitable attack vector (AV:N), low attack complexity (AC:L), and low-privilege requirements (PR:L), indicating that any authenticated user can trigger the flaw without user interaction. However, the impact is limited to confidentiality, integrity, and availability being partially compromised (C:L/I:L/A:L), not complete system compromise. The presence of publicly available exploit code (E:P per CVSS) elevates practical risk and reduces the barrier to weaponization. The vendor's non-response (RL:X) and lack of official patch confirmation suggest this vulnerability may remain unpatched in production deployments. From an SSVC perspective, this is an automatable attack requiring only authentication, with moderate technical impact sufficient to warrant remediation priority. Real-world risk is elevated by the ease of exploitation and public POC availability, despite the authentication barrier limiting the attacker pool to legitimate users or those with compromised credentials.

An authenticated user of Huly Platform crafts a malicious import request targeting the Import Endpoint (/server/front/src/index.ts or similar) with an SSRF payload, such as a URL pointing to http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint) or an internal service like http://localhost:5432 (database port). The server, without proper URL validation, fetches the attacker-supplied URL using its own network context and credentials, returning response data (metadata, error messages, or service responses) that reveals sensitive information or enables further attacks. Publicly available exploit code reduces the skill barrier, making this accessible to attackers with valid credentials or compromised accounts.