CVE-2026-91079

EUVD-2026-77714
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.5 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/hcengineering/platform
https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/config.ts
https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/server.ts
https://github.com/hcengineering/platform/issues/10908
https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-print-service