CVE-2026-37107: Htmly Htmly vulnerability
Published Oct 13, 2026
·Updated
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the getfeed function in the admin.php component
Affected Software
1 affected component
Htmly Htmly=3.1.1
Event History
Oct 13, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:17 PM
Description
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The available information identifies the issue as remotely exploitable, but does not specify whether authentication or any particular existing account privilege is required.
2
Which HTMLy versions are known to be affected?
HTMLy version 3.1.1 is identified as affected. The provided information does not establish an affected version range or a fixed version.
3
What component should be prioritized during investigation?
Investigation should focus on the get_feed function in the admin.php component, which is identified as the privilege-escalation path.