CVE-2026-5623
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker can send requests to internal network resources, potentially leading to sensitive data disclosure or further system compromise.
Recommendation
Immediately update Huly Platform to the latest version and implement URL validation in the Import endpoint.
Other vulnerabilities in Huly Platform
See all- CVE-2026-91079High
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
- CVE-2026-56769High
Huly Platform through version 0.7.423 contains an authenticated server-side request forgery (SSRF) vulnerability in the /import endpoint of the front pod. It allows workspace users to make arbitrary server requests by supplying malicious URLs.
- CVE-2026-12213Medium
Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-12212Medium
In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS