Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-91079Huly Platform through 0.7.426 SSRF via Print Service

High 8.5

In plain English

A high-severity server-side request forgery in platform from hcengineering. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

Affected products (as reported)

Vendor	Product	Versions
hcengineering	platform	0 – through 0.7.426

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GitHub Issue #10908 issue-tracking
https://github.com/hcengineering/platform product
pod-print server.ts at v0.7.426 technical-description
pod-print config.ts at v0.7.426 technical-description
VulnCheck Advisory: Huly Platform through 0.7.426 SSRF via Print Service third-party-advisory