CVE-2026-5346 Details
Description
A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A server-side request forgery (SSRF) vulnerability exists in huimeicloud's hmEditor version 2.2.3 and prior. The issue arises in the image-to-base64 endpoint within the src/mcp-server.js file, where the client.get function improperly validates user-supplied URLs. This flaw allows remote attackers to manipulate the URL parameter and make arbitrary HTTP requests from the server, potentially accessing internal resources or sensitive metadata endpoints. The vulnerability is present because the application trusts user input for outbound requests without adequate validation or restrictions, particularly against loopback addresses or private network ranges.
It is recommended to implement a strict URL allowlist, reject loopback and private network destinations after DNS resolution, and disable arbitrary user-supplied fetch and browser-navigation targets where not needed. Adding authentication, authorization, audit logging, and rate limiting around sensitive HTTP handlers can also help mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 2, 2026CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wing3e/public_exp/issues/11 | [email protected] | ExploitIssue TrackingTechnical Analysis |
| https://vuldb.com/submit/781341 | [email protected] | Permission Required |
| https://vuldb.com/vuln/354701 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/354701/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| huimeicloud hmEditor | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |