CVE-2026-57940: HTMLy 3.1.1 SSRF Vulnerability

CVE-2026-57940 Overview

CVE-2026-57940 is a Server-Side Request Forgery (SSRF) vulnerability in HTMLy 3.1.1, an open-source flat-file blogging platform. The flaw resides in the RSS feed import functionality accessible through the administrative Tools menu. The get_feed() function in system/admin/admin.php passes the user-supplied $feed_url parameter directly into file_get_contents() without validation or URL scheme restrictions. An authenticated administrator can supply arbitrary URLs, causing the server to issue outbound requests to attacker-chosen destinations. The weakness is classified under [CWE-918]. Exploitation requires high privileges, which limits real-world impact and is reflected in the low CVSS 4.0 score.

Critical Impact
An authenticated administrator can coerce the HTMLy server into fetching arbitrary URLs, enabling internal network reconnaissance, cloud metadata service access, and local file disclosure via the file:// scheme.

Affected Products

HTMLy 3.1.1
system/admin/admin.php component (get_feed() function)
Tools → Import RSS administrative feature

Discovery Timeline

2026-06-26 - CVE-2026-57940 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57940

Vulnerability Analysis

HTMLy exposes an RSS import feature that accepts a remote feed URL from an authenticated administrator. The get_feed() function in system/admin/admin.php (lines 1549-1551) forwards the submitted URL directly to PHP's file_get_contents(). No validation is performed on the URL scheme, host, or resolved IP address.

Because file_get_contents() in PHP supports multiple stream wrappers, the function will process http://, https://, file://, ftp://, php://, and other registered protocols. An attacker with administrator credentials can therefore submit URLs pointing to internal services, cloud instance metadata endpoints, or local files. The server dutifully performs the request and returns or processes the response.

The vulnerability requires administrative authentication, which mitigates opportunistic exploitation. However, in scenarios involving credential theft, insider threat, or chained vulnerabilities that yield administrator access, the SSRF becomes a useful pivot into otherwise unreachable network segments.

Root Cause

The root cause is missing input validation on user-controlled URLs before they are passed to a network-capable file access primitive. HTMLy does not enforce an allowlist of schemes, does not validate that the target host is externally routable, and does not restrict access to link-local addresses such as 169.254.169.254.

Attack Vector

An authenticated administrator navigates to Tools → Import RSS and submits a crafted URL. Representative payloads include http://dnslog.example.com for out-of-band interaction confirmation, file:///etc/passwd for local file disclosure, and http://169.254.169.254/latest/meta-data/ to retrieve AWS instance metadata and IAM credentials in cloud deployments.

The vulnerability manifests when file_get_contents($feed_url) is invoked without scheme or host filtering. See the GitHub PoC Repository for the exact vulnerable lines.

Detection Methods for CVE-2026-57940

Indicators of Compromise

Outbound HTTP requests from the HTMLy web server process to internal RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
Web server access logs showing POST requests to the RSS import endpoint followed by anomalous outbound network activity.
PHP error or warning entries referencing file_get_contents() with file://, php://, or ftp:// URIs.
Unexpected reads of sensitive local files such as /etc/passwd, /proc/self/environ, or application configuration files by the web server user.

Detection Strategies

Instrument the HTMLy host with egress monitoring that flags outbound connections to cloud metadata IPs and internal management interfaces.
Correlate authenticated administrator sessions with subsequent outbound connections initiated by the PHP-FPM or Apache worker process.
Deploy web application firewall rules that inspect the feed_url parameter for non-http(s) schemes and private IP literals.

Monitoring Recommendations

Enable PHP audit logging for calls to file_get_contents() and monitor for non-HTTP schemes.
Alert on any DNS resolution from the HTMLy host targeting canary or interaction domains commonly used by attackers.
Track administrator login events and pair them with network telemetry to identify abuse of privileged features.

How to Mitigate CVE-2026-57940

Immediate Actions Required

Restrict administrative access to HTMLy to trusted personnel and enforce strong authentication with multi-factor protection.
Disable or remove the RSS import feature if it is not required for daily operations.
Place the HTMLy server behind an egress proxy that blocks outbound requests to RFC1918, loopback, and link-local address ranges.
Rotate any cloud IAM credentials that may have been reachable from the affected instance via the metadata service.

Patch Information

At the time of publication no vendor patch is referenced in the NVD entry. Monitor the upstream project at the HTMLy GitHub repository for a fixed release. Recommended code-level remediation is to validate the submitted URL, reject non-http/https schemes, resolve the hostname, and refuse requests to private, loopback, and link-local IP ranges before invoking file_get_contents().

Workarounds

Configure PHP with allow_url_fopen=Off in php.ini to prevent remote URL access via file_get_contents(), accepting the functional impact on legitimate feed imports.
Deploy IMDSv2 with hop-limit enforcement on AWS instances to reduce the impact of metadata-service SSRF.
Apply network segmentation so that the HTMLy host cannot reach sensitive internal services or cloud management endpoints.
Remove or comment out the RSS import route in system/admin/admin.php until an official fix is available.

bash

# Example php.ini hardening to blunt SSRF exploitation
allow_url_fopen = Off
allow_url_include = Off
disable_functions = file_get_contents_url,fsockopen,pfsockopen