HTMLy: Server-side request forgery with arbitrary file read

Summary

HTMLy 3.1.1 passes the url parameter of the feed import (POST /admin/import) directly to file_get_contents() in get_feed() without restricting the URL scheme. An attacker with a valid admin session and CSRF token can read local files, such as the admin password hash, via file:// or similar wrappers, and probe internal network services. The NVD text describes this as privilege escalation, and the 9.8 score assumes no login is needed, which conflicts with the detailed write-up; the exact impact is therefore not yet confirmed.

Affected

• HTMLy 3.1.1 (named in the advisory references)
• OSV lists an affected range from v2.9.9 onward; this conflicts with the CVE and is unconfirmed
• Unknown.

Fixed in

Unknown. No vendor advisory or patched release has been found. An open pull request for v3.2.0 exists, but its fix for this CVE is not confirmed.

Workaround

• Disable the feed import function if it is not required.
• Keep display_errors=Off in production (this removes the in-band data reflection but does not fix the SSRF).
• Restrict access to /admin (IP allowlist, VPN or reverse-proxy authentication) and enforce strong, unique admin passwords with MFA where supported.

Exploitation

• A public proof-of-concept write-up exists on GitHub; the author reports validation in a lab environment.
• CISA SSVC assessment: exploitation 'poc', automatable: yes, technical impact: total.
• VulDB reports no exploit available (dated entry).
• No evidence of in-the-wild exploitation was found.

Our recommendation

• Identify whether any HTMLy installation exists in client environments.
• Disable the feed import function and restrict /admin access until a vendor fix is confirmed.
• Review admin accounts, rotate admin passwords and enable MFA where possible.
• Monitor the HTMLy releases page and apply the vendor fix as soon as it is published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  KyrieKlay/CVE-2026-37107

Research sources

• CVE-2026-37107 researcher write-up (GitHub Gist) gist.github.com
• HTMLy v3.1.1 release github.com
• CVE-2026-37107 proof-of-concept repository github.com
• VulDB entry 417860 vuldb.com
• OSV entry CVE-2026-37107 osv.dev
• Third-party intelligence entry 845149 cve.imfht.com
• HTMLy project website www.htmly.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:01.