An authenticated administrator can cause the HTMLy server to fetch arbitrary content by entering a crafted URL into the RSS feed import tool. The supplied address is passed directly to file_get_contents without validation, enabling the server to request internal cloud metadata, local files, or external resources. This can expose sensitive information or facilitate further attacks within the network. The weakness is classified as CWE‑918.

The affected product is HTMLy version 3.1.1 from the vendor danpros. Only installations of this version that expose the admin import RSS functionality are impacted.

The CVSS score is 2.1, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting low to moderate exploitation likelihood. Exploitation requires authentication with administrative privileges, so the attack surface is limited to users who have access to the admin panel. If credentials are compromised or the administration interface is broadly accessible, the SSRF can be used to exfiltrate data or perform internal reconnaissance.