CVE-2026-18645 in HTMLy
Summary
by MITRE • 08/04/2026
A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability resides within danpros HTMLy version 3.1.1 and earlier, specifically targeting the admin content endpoint functionality. The flaw exists in the add_content function located within the /system/admin/admin.php file, representing a critical path traversal vulnerability that enables unauthorized file system access. The vulnerability manifests when an attacker manipulates the oldfile argument parameter, allowing malicious actors to traverse directory structures beyond the intended application boundaries and potentially access sensitive files or execute arbitrary code.
The technical exploitation of this vulnerability follows a path traversal pattern that aligns with CWE-22 - Improper Limitation of a Pathname to a Restricted Directory. Attackers can leverage this flaw by crafting malicious input that manipulates the oldfile parameter to navigate through the file system hierarchy, potentially accessing configuration files, database credentials, or other sensitive resources. This type of vulnerability typically stems from inadequate input validation and sanitization within the application's file handling mechanisms.
The operational impact of this vulnerability is severe as it enables remote code execution capabilities when combined with other exploitation techniques. An attacker who successfully exploits this flaw can potentially gain unauthorized access to the server's file system, read sensitive data, modify content, or even escalate privileges if proper access controls are not in place. The vulnerability affects the administrative interface and could allow attackers to compromise the entire web application and underlying server infrastructure. This represents a direct threat to the confidentiality, integrity, and availability of the affected system.
Security practitioners should immediately implement mitigations including input validation and sanitization for all file path parameters, implementing proper access controls and authentication measures, and restricting file upload capabilities. The vulnerability also aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: PowerShell, as attackers may leverage the compromised system to execute malicious commands. Organizations should consider implementing web application firewalls, regular security audits, and monitoring for suspicious file access patterns. Additionally, the lack of vendor response despite early disclosure indicates a potential risk of unpatched systems remaining in production environments, highlighting the importance of proactive vulnerability management and alternative mitigation strategies.
The public availability of exploitation tools further compounds the risk, as it lowers the barrier to entry for potential attackers. This vulnerability demonstrates the critical importance of secure coding practices, particularly around file system operations, and emphasizes the need for regular security assessments and timely patch management. The affected component represents a common attack surface within content management systems where administrative functions often require elevated privileges and proper input validation mechanisms to prevent unauthorized access patterns that could lead to complete system compromise.