| Title | danpros htmly v3.1.1 (latest) Arbitrary File Move |
|---|
| Description | A path traversal vulnerability exists in htmly v3.1.1, a flat-file PHP CMS (https://github.com/danpros/htmly). The add_content() function in /system/admin/admin.php (line 259) receives the 'oldfile' parameter from $_REQUEST['oldfile'] (htmly.php line 1029) and passes it directly to PHP's rename() function without any path validation. No realpath() check, basename() extraction, or ../ filtering is applied. An authenticated attacker can move arbitrary server files to the application's content directory by supplying a malicious path with ../ sequences, e.g. oldfile=../../../etc/passwd. This enables overwriting critical files (config.ini), exposing sensitive data (.env, backups), or disrupting application functionality. The vulnerability was identified through source code audit and confirmed by tracing the data flow from user input ($_REQUEST) to the sink function (rename). CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High). Fix: validate source path with realpath() and restrict operations to the content directory. |
|---|
| Source | ⚠️ https://github.com/orionyan520/cve_report/issues/6 |
|---|
| User | orionyan (UID 98777) |
|---|
| Submission | 06/10/2026 11:01 (2 months ago) |
|---|
| Moderation | 08/03/2026 13:19 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 385564 [danpros HTMLy up to 3.1.1 Admin Content Endpoint /system/admin/admin.php add_content oldfile path traversal] |
|---|
| Points | 20 |
|---|