CVE-2026-56769

HIGH 8.5

Huly Platform - Server-Side Request Forgery via /import Endpoint

CVSS Score

8.5

EPSS Score

0.0%

EPSS Percentile

0th

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.

CWE	CWE-918
Vendor	hcengineering
Product	platform
Published	Jun 25, 2026
Last Updated	Jun 25, 2026

Stay Ahead of the Next One

Get instant alerts for hcengineering platform

Be the first to know when new high vulnerabilities affecting hcengineering platform are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

hcengineering / platform

0 ≤ 0.7.423

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/hcengineering/platform/issues/10892 github.com: https://github.com/hcengineering/platform/pull/10910 github.com: https://github.com/hcengineering/platform/commit/68cbf8a88642d8313f151a274fb5c24dee6a2762 vulncheck.com: https://www.vulncheck.com/advisories/huly-platform-server-side-request-forgery-via-import-endpoint

Credits

George Chen