CVE-2026-37107
Deferred Deferred - Pending Action

Privilege Escalation in HTMLy via admin.php

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: MITRE

Description
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-37107
EUVD
EUVD-2026-99005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in HTMLy version 3.1.1. It allows a remote attacker to escalate their privileges by exploiting the get_feed function in the admin.php component.

Detection Guidance

Check if HTMLy v3.1.1 is installed by inspecting the version in the admin panel or config files. Look for suspicious POST requests to /admin/import with URLs using file://, php://filter, or http:// schemes. Review error logs for reflected content if display_errors is enabled. Test for SSRF by attempting to access internal services or local files via the get_feed function.

Impact Analysis

An attacker could gain higher-level access to the system, potentially allowing them to take control of the website or steal sensitive data.

Compliance Impact

This vulnerability allows attackers to read arbitrary local files, including sensitive files like admin password hashes. This could lead to unauthorized access, data breaches, or exposure of personal data, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements for safeguarding sensitive information.

Mitigation Strategies

Immediately update HTMLy to the latest version beyond v3.1.1 to address the privilege escalation vulnerability in the get_feed function. Disable admin.php access if not required and restrict network access to administrative interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-37107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart