CVE-2026-5346 | huimeicloud hm_editor up to 2.2.3 image-to-base64 Endpoint src/mcp-server.js client.get url server-side request forgery

A vulnerability labeled as critical has been found in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery.

This vulnerability is registered as CVE-2026-5346. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.