| शीर्षक | danpros htmly v3.1.1 (latest) Path Traversal |
|---|
| विवरण | A path traversal vulnerability exists in htmly v3.1.1, a flat-file PHP CMS (https://github.com/danpros/htmly). The /author/:name route handler in /system/htmly.php (lines 300-312) concatenates the user-supplied URL parameter 'name' directly into filesystem paths without sanitization. The name value is used to construct two paths: 'config/users/$name.ini' and '$vroot/layout--profile--$name.html.php', which are then checked with file_exists(). The strtolower() function applied to the second path does not block ../ sequences. This vulnerability requires no authentication — the /author/:name route is publicly accessible. An unauthenticated attacker can probe arbitrary server file existence via differential HTTP responses (200 vs 404), enabling filesystem mapping, configuration file verification, and user enumeration. The vulnerability was identified through source code audit of the route handler. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium). Fix: reject name values containing ../, /, or backslash before filesystem operations, or validate the resolved path with realpath(). |
|---|
| स्रोत | ⚠️ https://github.com/orionyan520/cve_report/issues/7 |
|---|
| उपयोगकर्ता | orionyan (UID 98777) |
|---|
| सबमिशन | 10/06/2026 11:02 AM (2 महीनों पहले) |
|---|
| संयम | 03/08/2026 01:19 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385565 [danpros HTMLy तक 3.1.1 Author Name /system/htmly.php नाम निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|