Executive brief
HTMLy, an open-source blogging platform, contains a security flaw in its RSS feed import tool. An authorized administrator can force the server to make unintended network requests to internal systems or external websites. This could be used to scan internal networks, access sensitive cloud metadata, or read local system files, potentially leading to further compromise of the hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) exists in HTMLy 3.1.1 within the RSS feed import functionality. The 'get_feed()' function in 'system/admin/admin.php' accepts a user-provided '$feed_url' and passes it directly to PHP's 'file_get_contents()' without validation or sanitization. An authenticated attacker with administrative privileges can provide malicious URLs using various schemes, such as 'file://' to read local files (e.g., /etc/passwd) or 'http://' to target internal network services and cloud metadata endpoints (e.g., 169.254.169.254). The vulnerability is reachable via the 'Tools -> Import RSS' administrative interface.
Affected products
- danpros HTMLy 3.1.1
Timeline
- 2026-06-26: advisory: CVE-2026-57940 published by MITRE/NVD