CVE-2026-57940 Server-side request forgery in HTMLy
An authenticated admin can trigger SSRF in HTMLy's RSS import, allowing access to internal resources or cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57940?
CVE-2026-57940 is a low-severity server-side request forgery vulnerability in danpros HTMLy, published on 26 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.
Weakness: CWE-918
Which versions are affected by CVE-2026-57940?
How do I fix CVE-2026-57940?
No fix has been published for CVE-2026-57940 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-57940 being exploited?
There is no known exploitation of CVE-2026-57940 in the wild and no public exploit code.
Sources
Also known as GHSA-fpm8-6xjp-2hq8.