Executive brief
huimeicloud hm_editor is a component used for content editing and image processing. A security flaw in its image-to-base64 conversion feature allows remote attackers to force the server to make unauthorized requests to internal or external websites. This could lead to the exposure of sensitive internal data, access to private cloud metadata, or disruptions to internal services.
Technical details
A server-side request forgery (SSRF) vulnerability exists in huimeicloud hm_editor versions up to 2.2.3. The vulnerability is located in the `client.get` function within `src/mcp-server.js` and the `page.goto` method in `src/print.js`. The application fails to validate the `url` parameter provided in HTTP POST requests to the `/image-to-base64` endpoint, passing it directly to outbound request sinks. A remote, unauthenticated attacker can exploit this to probe internal network resources, access cloud instance metadata (IMDS), or interact with internal services that are not exposed to the internet. As of the advisory date, the vendor has not responded to disclosure attempts and no patch is available.
Affected products
- huimeicloud hm_editor up to 2.2.3
Timeline
- 2026-03-15: disclosed: Vulnerability reported by independent researcher Winegee
- 2026-04-02: advisory: Initial disclosure via VulDB and NVD