High severity · published Sep 14, 2026
CVE-2026-91079
Huly Platform through 0.7.426 SSRF via Print Service
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
platform · hcengineering
through 0.7.426 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91079
github.com
https://github.com/hcengineering/platform
github.com
https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/config.ts
github.com
https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/server.ts
github.com
https://github.com/hcengineering/platform/issues/10908
www.vulncheck.com
https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-print-service
More from platform
8.5
CVE-2026-56769
Huly Platform - Server-Side Request Forgery via /import Endpoint