Is CVE-2026-18645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18645 being exploited in the wild.

How severe is CVE-2026-18645?

Medium severity, with a CVSS score of 5.4, published 3 August 2026.

Is there a fix for CVE-2026-18645?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18645 attacked?

It is attacked over the network.

Am I affected by CVE-2026-18645?

Check whether you run Danpros HTMLy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18645: danpros HTMLy path traversal in admin content endpoint

CVE-2026-18645 · Severity: medium · CVSS 5.4 · Published 2026-08-03

HTMLy is a flat-file content management system used to power blogging platforms without a database. An authenticated attacker can exploit a path traversal flaw in the content editing function to move arbitrary files from the server to web-accessible directories, potentially exposing sensitive configuration files, environment variables, or backups, or overwriting critical application files to disrupt service.

Technologies: Danpros HTMLy. Vendors: Danpros.

Quick answers

Is CVE-2026-18645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18645 being exploited in the wild.
How severe is CVE-2026-18645?: Medium severity, with a CVSS score of 5.4, published 3 August 2026.
Which products and versions are affected?: Danpros HTMLy up to 3.1.1.
Is there a fix for CVE-2026-18645?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18645 attacked?: It is attacked over the network.
Am I affected by CVE-2026-18645?: Check whether you run Danpros HTMLy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the add_content() function of /system/admin/admin.php, where the oldfile parameter sourced directly from $_REQUEST['oldfile'] is passed to PHP's rename() function without validation. The vulnerable code accepts user input and applies no realpath() checks, basename() extraction, or directory traversal filtering before invoking rename(). An authenticated user can supply a path such as ../../../etc/passwd to move arbitrary server files to the content directory, making them web-accessible or overwriting application files. The attack requires a valid authenticated session (login is enforced via login() check), but the vulnerability has been disclosed publicly and a proof-of-concept is available. No vendor patch has been released despite early disclosure notification.

Affected products

danpros HTMLy up to 3.1.1

Timeline

2026-06-10: disclosed: Vulnerability reported on GitHub
2026-08-03: advisory: CVE-2026-18645 published
2026: other: Vendor contacted early but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.