This vulnerability affects the hcengineering Huly Platform 0.7.382 in the Import Endpoint component located in the file server/front/src/index.ts. It enables an attacker to perform server-side request forgery (SSRF) by manipulating requests remotely. The vulnerability was publicly disclosed without vendor response or patch availability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to send crafted requests to internal or external systems. This may lead to information disclosure or interaction with internal services not normally accessible. However, the impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS score. No confirmed exploitation in the wild has been reported.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Patch status is not yet confirmed — check the vendor advisory or hcengineering communications for any updates. Until a fix is provided, consider restricting network access from the affected component and monitoring for unusual request patterns related to the Import Endpoint.