CVE-2026-5623
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker can send requests to internal network resources, potentially leading to sensitive data disclosure or further system compromise.
Recommendation
Immediately update Huly Platform to the latest version and implement URL validation in the Import endpoint.
Original NVD description (English source)
A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.