CVE-2026-57940

HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.

• CWE-918

• https://github.com/danpros/htmly/blob/c8b7ed9af39a266b256759becf26dba6a59e11e6/system/admin/admin.php#L1549-L1551

Published

Jun 26, 2026

Last Modified

Jun 26, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57923In JetBrains YouTrack before 2026.2.16593 improper authorisa…7.5
• CVE-2026-57924In JetBrains YouTrack before 2026.2.16593 default role confi…5.3
• CVE-2026-57925In JetBrains YouTrack before 2026.2.16593 improper access co…5.3
• CVE-2026-57926In JetBrains YouTrack before 2026.2.16593 the websandbox bri…9.8
• CVE-2026-5793Improper neutralization of input during web page generation …6.1
• CVE-2026-5794A vulnerability affecting the detailed versions of Cryptobox…4.9
• CVE-2026-57942LibreTranslate through 1.9.7, fixed in commit 397fd22, conta…6.9
• CVE-2026-57943LibrePhotos before 1.0.0 contains a broken object level auth…6
• CVE-2026-57945PhotoPrism before 260601-a7d098548 contains a broken access …5.3
• CVE-2026-57946Invidious before version 2.20260626.0 contains a broken acce…6.3
• CVE-2026-57947Pinpoint through 3.1.0 contains a server-side request forger…8.5
• CVE-2026-57948Pinpoint through version 3.1.0 contains an insecure session …7.6