External risk intelligence

HTMLy get_feed Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-37107

HTMLy is a flat-file CMS typically deployed as a public-facing web application. Since it serves as a website content management system, it is designed to be accessible over the internet to serve content and provide administrative interfaces, making its attack surface commonly exposed in real-world deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability identified in HTMLy, a flat-file content management system. The issue, if exploited, could allow unauthorized remote access to elevate privileges within the system. Given the nature of content management systems, this could potentially impact the integrity and availability of websites they host. The primary concern is to confirm if HTMLy is in use and assess any potential exposure.

Attackers can gain higher system control.
Affects website content management systems.
Confirm if this technology is used.

Attack Path

How an attacker could exploit the issue

An attacker can gain unauthorized administrative control of a vulnerable HTMLy installation by sending a specially crafted request to the `get_feed` function. This function, located in the `admin.php` component, is susceptible to privilege escalation, allowing an unauthenticated remote attacker to execute actions with administrative privileges.

Requires network access.
Triggered via a specific function call.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

An attacker could potentially escalate privileges within an HTMLy installation through a vulnerability in the `get_feed` function. This could affect the integrity and availability of the system, and potentially lead to unauthorized access to administrative functions.

System data and administrative access.
Via a network request to the admin component.
Unauthorized administrative control of the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts HTMLy, a flat-file CMS often deployed as a public-facing web application. The first practical step is to identify all HTMLy instances, determine their reachability and business criticality, and locate the accountable owners. Remediation planning should then be prioritized based on these findings.

Identify all HTMLy instances and owners.
Verify exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HTMLy?

HTMLy is a flat-file content management system (CMS) that operates without a traditional database. Developers and bloggers use it to create lightweight, fast-loading websites by storing content in simple files. Because it is a CMS, it manages the structural and administrative aspects of a site, making it a central component for those hosting digital content.

What does CWE-269 mean for CVE-2026-37107?

CWE-269 is the weakness class for Improper Privilege Management. In this vulnerability, it means the software fails to correctly verify the user's role before granting them higher-level access. For CVE-2026-37107, this signifies that an unauthorized user can bypass standard security restrictions to obtain administrative control over the CMS.

How is the get_feed function triggered in this CVE?

An attacker triggers this flaw by sending a specifically formatted network request to the get_feed function within the admin.php component. The vulnerability is tied to this specific endpoint; simply browsing the public-facing areas of a website or viewing standard pages does not activate the privilege escalation path. The exploit requires interaction with this administrative code.

Do I need to worry if my HTMLy site is online?

Yes, you should prioritize this. Halo Surface Signal notes that HTMLy is typically deployed as a public-facing web application, meaning its administrative interfaces are often intended to be accessible over the internet. Because the attack vector is network-based and does not require authentication, any instance reachable from the internet faces a higher risk of exploitation.

What is the first step to address this issue?

Begin by creating a comprehensive inventory of all HTMLy installations in your environment. Once identified, verify which instances are reachable from the internet versus those on internal networks, and determine the business criticality of each site. Assign ownership to these assets immediately so you can coordinate the necessary remediation steps once an update or configuration change is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.