{"id":"CVE-2026-5623","state":"PUBLISHED","title":"hcengineering Huly Platform Import Endpoint index.ts server-side request forgery","description":"A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-04-06T04:45:10.664Z","updatedAt":"2026-04-06T15:01:14.197Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["hcengineering Huly Platform"],"affected":[{"vendor":"hcengineering","product":"Huly Platform","versions":[{"version":"0.7.382","status":"affected"}],"modules":["Import Endpoint"]}],"references":["https://vuldb.com/vuln/355413","https://vuldb.com/vuln/355413/cti","https://vuldb.com/submit/785632"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5623.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5623","state":"PUBLISHED","datePublished":"2026-04-06T04:45:10.664Z","dateUpdated":"2026-04-06T15:01:14.197Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-05T16:06:15.134Z"},"containers":{"cna":{"title":"hcengineering Huly Platform Import Endpoint index.ts server-side request forgery","descriptions":[{"lang":"en","value":"A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"hcengineering","product":"Huly Platform","versions":[{"version":"0.7.382","status":"affected"}],"modules":["Import Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/355413","name":"VDB-355413 | hcengineering Huly Platform Import Endpoint index.ts server-side request forgery","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/355413/cti","name":"VDB-355413 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/785632","name":"Submit #785632 | hcengineering platform  v0.7.382 Server-Side Request Forgery","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","type":"CWE","lang":"en","description":"Server-Side Request Forgery"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-06T04:45:10.664Z"},"timeline":[{"time":"2026-04-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-05T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-05T18:11:25.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Ghufran Khan (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/submit/785632","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-06T15:01:11.098523Z","id":"CVE-2026-5623","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-06T15:01:14.197Z"}}]}}}