Executive brief
HTMLy is a flat-file blogging platform (CMS) that does not require a database. An authenticated administrator can exploit a path traversal vulnerability in the user deletion function to delete arbitrary files on the server. An attacker with admin credentials could delete critical configuration files, causing application outage, or remove other important system files, leading to data loss or further system compromise.
Technical details
A path traversal vulnerability (CWE-22) exists in the /admin/users/:username/delete POST handler in /system/htmly.php. The handler receives a file parameter from the HTTP request and passes it directly to PHP's unlink() function without any sanitization, realpath() validation, basename() extraction, or path filtering. An authenticated administrator with a valid CSRF token can supply an arbitrary absolute or relative file path to delete any file writable by the PHP process. The attack requires prior admin authentication and a valid CSRF token; no fix has been announced by the vendor.
Affected products
- danpros HTMLy up to 3.1.1
Timeline
- 2026-06-10: disclosed
- 2026-08-03: advisory