CVE-2026-57940: SSRF
HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function getfeed() in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57940?
CVE-2026-57940 has a risk rating of 37, indicating a significant security concern.
How do I fix CVE-2026-57940?
To fix CVE-2026-57940, validate and sanitize the user-supplied $feed_url in the get_feed() function before using it.
What vulnerability type is identified in CVE-2026-57940?
CVE-2026-57940 identifies a Server-Side Request Forgery (SSRF) vulnerability.
Can an attacker exploit CVE-2026-57940 without authentication?
No, exploitation of CVE-2026-57940 requires the attacker to be authenticated with administrative privileges.
Which software is affected by CVE-2026-57940?
CVE-2026-57940 affects HTMLy version 3.1.1.