Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-5623: Huly Platform Import Endpoint Allows Remote Server Attack
CVE-2026-5623 · published 7 months ago
Summary
An attacker can use a publicly available exploit to remotely attack the Huly Platform's Import Endpoint, potentially leading to unauthorized actions. This affects version 0.7.382 of the platform. We recommend that users update to a patched version as soon as possible to prevent potential attacks.
Original advisory text
A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads t...
A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published6 Apr 2026
Updated3 Nov 2026
First seen6 Apr 2026
Sources
CVE-2026-5623 · NVD
Track software like this
Free during beta