| 제목 | danpros htmly v3.1.1 (latest) Arbitrary File Move |
|---|
| 설명 | A path traversal vulnerability exists in htmly v3.1.1, a flat-file PHP CMS (https://github.com/danpros/htmly). The add_content() function in /system/admin/admin.php (line 259) receives the 'oldfile' parameter from $_REQUEST['oldfile'] (htmly.php line 1029) and passes it directly to PHP's rename() function without any path validation. No realpath() check, basename() extraction, or ../ filtering is applied. An authenticated attacker can move arbitrary server files to the application's content directory by supplying a malicious path with ../ sequences, e.g. oldfile=../../../etc/passwd. This enables overwriting critical files (config.ini), exposing sensitive data (.env, backups), or disrupting application functionality. The vulnerability was identified through source code audit and confirmed by tracing the data flow from user input ($_REQUEST) to the sink function (rename). CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High). Fix: validate source path with realpath() and restrict operations to the content directory. |
|---|
| 원천 | ⚠️ https://github.com/orionyan520/cve_report/issues/6 |
|---|
| 사용자 | orionyan (UID 98777) |
|---|
| 제출 | 2026. 06. 10. AM 11:01 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 03. PM 01:19 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 385564 [danpros HTMLy 까지 3.1.1 Admin Content Endpoint /system/admin/admin.php add_content oldfile 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|