HTMLy EUVD-2026-39660

Exploitation strictly requires an authenticated session with administrative privileges in HTMLy (PR:H per CVSS vector); there is no unauthenticated or low-privilege path to the vulnerable get_feed() function. The attacker must reach the admin panel's Tools → Import RSS interface. The highest-impact exploitation variant (cloud credential theft via 169.254.169.254) additionally requires: the HTMLy instance to be hosted on a cloud provider, IMDSv1 to be accessible from the web server process (not mitigated by IMDSv2 hop-limit enforcement), and the cloud instance to have an IAM role with credentials attached. Local file read via file:// requires PHP's allow_url_fopen to be enabled (on by default) and the web server process to have read permission on the target file. What limits exploitation: full admin access is a prerequisite; cloud-specific impact requires a cloud-hosted deployment with permissive IMDS configuration; no network-level unauthenticated exposure exists.

Real-world risk is low despite the SSRF class of vulnerability. The CVSS 4.0 vector (PR:H) confirms exploitation is restricted to users who already hold full administrative control of the HTMLy instance - an attacker at that privilege level has numerous higher-impact options available. The AT:P modifier indicates a prerequisite attack target condition: the most impactful exploitation path (cloud metadata credential theft via 169.254.169.254) requires the server to be deployed on a cloud provider with IMDSv1 enabled and without hop-limit enforcement. No EPSS score was provided; no KEV listing exists; no POC exploit code has been identified. The CVSS 4.0 base score of 2.1 appropriately reflects these constraints. The primary realistic concern is cloud-hosted HTMLy instances where an admin account compromise could be chained to IMDSv1 metadata exfiltration - a meaningful but narrow threat. For on-premises deployments without cloud metadata endpoints, risk is further reduced to internal network probing and local file read, both limited by the admin access prerequisite.

An attacker who has obtained HTMLy administrator credentials - through credential stuffing, phishing, or a prior compromise - navigates to the Tools → Import RSS page and submits http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the feed URL. The server issues the HTTP request and the attacker reads the cloud IAM role credentials from the response, enabling lateral movement within the cloud environment. Alternatively, submitting file:///etc/passwd retrieves local system user information, aiding further privilege escalation on the host.