Vulnerability Description
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/hcengineering/platform
- https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print
- https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print
- https://github.com/hcengineering/platform/issues/10908
- https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-prin
FAQ
What is CVE-2026-91079?
CVE-2026-91079 is a vulnerability with a CVSS score of 8.5 (HIGH). Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitra...
How severe is CVE-2026-91079?
CVE-2026-91079 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91079?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.