CVE-2026-91079CWE-918ssrf

CVE-2026-91079

High · published September 14, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00369 · 29.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-14T22:20Z
References (5)
https://github.com/hcengineering/platform · [email protected]https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/config.ts · [email protected]https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/server.ts · [email protected]https://github.com/hcengineering/platform/issues/10908 · [email protected]https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-print-service · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 17:52Z
    Huly Platform through 0.7.426 SSRF via Print Service
    cvelistv5