hcengineering vulnerabilities

Products

• huly platform 4
• hcengineering/platform 3
• huly 2

Latest hcengineering CVEs

Newest publication first

1. CVE-2026-111606 Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

   Published 2026-10-16

   High·CVSS 8.6 EPSS 0.24%

   Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto...

2. CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service

   Published 2026-09-14

   Medium·CVSS 6.3 EPSS 0.37%

   Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadab...

3. CVE-2026-56769 Huly Platform - Server-Side Request Forgery via /import Endpoint

   Published 2026-06-25

   Medium·CVSS 6.3 EPSS 0.37%

   Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to...

4. CVE-2026-12213 hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization

   Published 2026-06-15

   Medium·CVSS 5.3 EPSS 0.20%

   A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/src/operations.ts of the component User Information Handler. The manipulation results in improper authorization. The atta...

5. CVE-2026-12212 hcengineering Huly Platform RPC operations.ts getMailboxSecret access control

   Published 2026-06-15

   Medium·CVSS 5.3 EPSS 0.21%

   A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to improper access controls. The attack may be initiated remote...

6. CVE-2026-5623 hcengineering Huly Platform Import Endpoint index.ts server-side request forgery

   Published 2026-04-06

   Medium·CVSS 5.3 EPSS 0.20%

   A vulnerability was identified in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit is...

7. CVE-2026-5622 hcengineering Huly Platform JWT Token token.ts hard-coded key

   Published 2026-04-06

   Medium·CVSS 6.3 EPSS 0.26%

   A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packages/token/src/token.ts of the component JWT Token Handler. This manipulation of the argument SERVER_SECRET with the input...

8. CVE-2024-48450 An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group.

   Published 2024-10-25

   Medium·CVSS 6.5 EPSS 0.53%

   An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group.

9. CVE-2024-27707 Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file.

   Published 2024-03-07

   Medium·CVSS 4.3 EPSS 0.33%

   Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.