This vulnerability in hcengineering Huly Platform 0.7.382 allows an attacker to manipulate the Import Endpoint, causing server-side request forgery. The affected code resides in the file server/front/src/index.ts. Exploitation can be performed remotely and does not require user interaction or elevated privileges. The vendor has not provided any advisory or patch, and the remediation status is unknown. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server, potentially accessing internal resources or services not otherwise exposed. The impact is rated medium based on the CVSS score of 5.3. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for updates from hcengineering. Until a patch is available, consider implementing network-level controls to restrict outbound requests from the affected component if possible.