Executive brief
Huly Platform, an open-source business management and workflow tool, contains a security flaw in its data import feature. An authorized user of a workspace can exploit this to force the server to make unauthorized requests to internal systems or external websites. This could allow an attacker to scan private internal networks, steal sensitive data from other internal services, or bypass security controls protecting the backend infrastructure.
Technical details
An authenticated server-side request forgery (SSRF) vulnerability exists in the Huly Platform's 'front' pod within the /import endpoint. The vulnerability is caused by insufficient validation of user-supplied URLs, allowing an attacker with workspace-level permissions to initiate arbitrary network requests from the server. By providing a malicious URL, an attacker can perform internal port scanning, access internal-only services (such as metadata services or internal APIs), and potentially exfiltrate sensitive data or replay credentials against backend systems. The issue is tracked as CWE-918 and was addressed by implementing a URL guard/validation mechanism in commit 68cbf8a.
Affected products
- Huly Platform through 0.7.423
Timeline
- 2026-06-16: patched: Fix commit and pull request submitted
- 2026-06-25: disclosed: Vulnerability published by VulnCheck and NVD