CVE-2026-21826CWE-601

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection

Medium · published June 5, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-05T05:58Z
EPSS history
Timeline
  • 05 JUN 05:58Z
    HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection
    cvelistv5