| शीर्षक | danpros htmly v3.1.1 (latest) Arbitrary File Move |
|---|
| विवरण | A path traversal vulnerability exists in htmly v3.1.1, a flat-file PHP CMS (https://github.com/danpros/htmly). The add_content() function in /system/admin/admin.php (line 259) receives the 'oldfile' parameter from $_REQUEST['oldfile'] (htmly.php line 1029) and passes it directly to PHP's rename() function without any path validation. No realpath() check, basename() extraction, or ../ filtering is applied. An authenticated attacker can move arbitrary server files to the application's content directory by supplying a malicious path with ../ sequences, e.g. oldfile=../../../etc/passwd. This enables overwriting critical files (config.ini), exposing sensitive data (.env, backups), or disrupting application functionality. The vulnerability was identified through source code audit and confirmed by tracing the data flow from user input ($_REQUEST) to the sink function (rename). CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High). Fix: validate source path with realpath() and restrict operations to the content directory. |
|---|
| स्रोत | ⚠️ https://github.com/orionyan520/cve_report/issues/6 |
|---|
| उपयोगकर्ता | orionyan (UID 98777) |
|---|
| सबमिशन | 10/06/2026 11:01 AM (2 महीनों पहले) |
|---|
| संयम | 03/08/2026 01:19 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385564 [danpros HTMLy तक 3.1.1 Admin Content Endpoint /system/admin/admin.php add_content oldfile निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|