| タイトル | danpros htmly v3.1.1 (latest) Arbitrary File Move |
|---|
| 説明 | A path traversal vulnerability exists in htmly v3.1.1, a flat-file PHP CMS (https://github.com/danpros/htmly). The add_content() function in /system/admin/admin.php (line 259) receives the 'oldfile' parameter from $_REQUEST['oldfile'] (htmly.php line 1029) and passes it directly to PHP's rename() function without any path validation. No realpath() check, basename() extraction, or ../ filtering is applied. An authenticated attacker can move arbitrary server files to the application's content directory by supplying a malicious path with ../ sequences, e.g. oldfile=../../../etc/passwd. This enables overwriting critical files (config.ini), exposing sensitive data (.env, backups), or disrupting application functionality. The vulnerability was identified through source code audit and confirmed by tracing the data flow from user input ($_REQUEST) to the sink function (rename). CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High). Fix: validate source path with realpath() and restrict operations to the content directory. |
|---|
| ソース | ⚠️ https://github.com/orionyan520/cve_report/issues/6 |
|---|
| ユーザー | orionyan (UID 98777) |
|---|
| 送信 | 2026年06月10日 11:01 (2 月 ago) |
|---|
| モデレーション | 2026年08月03日 13:19 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 385564 [danpros HTMLy 迄 3.1.1 Admin Content Endpoint /system/admin/admin.php add_content oldfile ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|