HIGH

CVE-2026-91079

2026-09-14 CVSS v3.1

CVSS

8.5

Description

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

EPSS Score

0.35%

Probability of exploitation in next 30 days

29.1th percentile

References

https://github.com/hcengineering/platform https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/config.ts https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/server.ts https://github.com/hcengineering/platform/issues/10908 https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-print-service

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE