CVE-2026-37107

Summary

A privilege escalation vulnerability in HTMLy v3.1.1 allows remote attackers to gain administrative privileges through the get_feed function in admin.php, potentially leading to full system compromise.

Exploitability

The vulnerability is highly exploitable with no authentication required, allowing attackers to escalate privileges remotely with minimal preconditions.

Blast radius

If exploited, this flaw could enable attackers to fully compromise HTMLy installations, gaining complete administrative control over content management and potentially leading to data breaches or further network infiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to HTMLy v3.1.2 or later to address this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.