Description
A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑side request forgery
Action: Immediate Patch
AI Analysis

Impact

The issue is a server‑side request forgery vulnerability in hcengineering Huly Platform 0.7.382, located in the Import Endpoint module. An attacker can trigger the server to make arbitrary outbound HTTP requests by sending a crafted payload, allowing control over traffic from the server. This flaw provides a moderate risk to confidentiality and integrity, as attackers could exfiltrate data or send requests to arbitrary internal resources.

Affected Systems

hcengineering Huly Platform version 0.7.382 is affected. The vulnerability resides in the component Import Endpoint within file server/front/src/index.ts. No other versions or products are known to be impacted at this time.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. The exploit is publicly available, can be triggered remotely, and no EPSS data is provided. The issue is not listed in CISA’s KEV catalog. The lack of vendor response suggests that the exploit is likely still actionable. Attackers could leverage it to force the platform to reach internal services or exfiltrate information.

Generated by OpenCVE AI on April 6, 2026 at 07:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for a patched or newer version of hcengineering Huly Platform and upgrade if available.
  • If no update is available, restrict outbound network access from the Import Endpoint to trusted destinations only.
  • Apply network filtering or firewall rules to block unintended outgoing traffic from the affected server.
  • Monitor application logs for unusual outbound request activity and investigate anomalies promptly.
  • Contact the vendor again or seek alternative security controls to mitigate the risk.

Generated by OpenCVE AI on April 6, 2026 at 07:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Hcengineering
Hcengineering huly
Vendors & Products Hcengineering
Hcengineering huly

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Apr 2026 05:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hcengineering Huly
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T15:01:14.197Z

Reserved: 2026-04-05T16:06:15.134Z

Link: CVE-2026-5623

cve-icon Vulnrichment

Updated: 2026-04-06T15:01:03.891Z

cve-icon NVD

Status : Deferred

Published: 2026-04-06T06:16:19.910

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:47:24Z

Weaknesses