Danpros

**Name of the Vulnerable Software and Affected Versions** HTMLy version 3.1.1 **Description** A Server-Side Request Forgery (SSRF) issue exists in the RSS feed import functionality. The function `get feed()` in system/admin/admin.php passes the user-supplied `feed url` variable directly to `file get contents()` without validation. An authenticated attacker with administrative privileges can exploit this by providing a crafted URL via the Tools -> Import RSS interface, causing the server to make requests to an attacker-controlled target. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.