{"id":"CVE-2026-37107","published":"2026-10-13T18:17:23.847","lastModified":"2026-10-16T19:56:15.773","description":"An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/KyrieKlay/b61a7563d7887d2a01060fcb0bf825eb","tags":[]},{"url":"https://github.com/danpros/htmly/releases/tag/v3.1.1","tags":[]},{"url":"https://www.htmly.com/","tags":[]},{"url":"https://gist.github.com/KyrieKlay/b61a7563d7887d2a01060fcb0bf825eb","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/KyrieKlay/b61a7563d7887d2a01060fcb0bf825eb","tags":[]},{"url":"https://github.com/danpros/htmly/releases/tag/v3.1.1","tags":[]},{"url":"https://gist.github.com/KyrieKlay/b61a7563d7887d2a01060fcb0bf825eb","tags":[]}],"hasPoc":true,"ai":{"summary":"A privilege escalation vulnerability in HTMLy v3.1.1 allows remote attackers to gain administrative privileges through the get_feed function in admin.php, potentially leading to full system compromise.","exploitability":"The vulnerability is highly exploitable with no authentication required, allowing attackers to escalate privileges remotely with minimal preconditions.","blast_radius":"If exploited, this flaw could enable attackers to fully compromise HTMLy installations, gaining complete administrative control over content management and potentially leading to data breaches or further network infiltration.","remediation":"Upgrade to HTMLy v3.1.2 or later to address this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","web","admin-panel"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:47:03.376Z"}}