| tiêu đề | danpros htmly v3.1.1 (latest) Arbitrary File Move |
|---|
| Mô tả | A path traversal vulnerability exists in htmly v3.1.1, a flat-file PHP CMS (https://github.com/danpros/htmly). The add_content() function in /system/admin/admin.php (line 259) receives the 'oldfile' parameter from $_REQUEST['oldfile'] (htmly.php line 1029) and passes it directly to PHP's rename() function without any path validation. No realpath() check, basename() extraction, or ../ filtering is applied. An authenticated attacker can move arbitrary server files to the application's content directory by supplying a malicious path with ../ sequences, e.g. oldfile=../../../etc/passwd. This enables overwriting critical files (config.ini), exposing sensitive data (.env, backups), or disrupting application functionality. The vulnerability was identified through source code audit and confirmed by tracing the data flow from user input ($_REQUEST) to the sink function (rename). CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High). Fix: validate source path with realpath() and restrict operations to the content directory. |
|---|
| Nguồn | ⚠️ https://github.com/orionyan520/cve_report/issues/6 |
|---|
| Người dùng | orionyan (UID 98777) |
|---|
| Đệ trình | 10/06/2026 11:01 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 03/08/2026 13:19 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 385564 [danpros HTMLy đến 3.1.1 Admin Content Endpoint /system/admin/admin.php add_content oldfile duyệt thư mục] |
|---|
| điểm | 20 |
|---|