Executive brief
HTMLy is a flat-file content management system used to power blogging platforms without a database. An authenticated attacker can exploit a path traversal flaw in the content editing function to move arbitrary files from the server to web-accessible directories, potentially exposing sensitive configuration files, environment variables, or backups, or overwriting critical application files to disrupt service.
Technical details
A path traversal vulnerability exists in the add_content() function of /system/admin/admin.php, where the oldfile parameter sourced directly from $_REQUEST['oldfile'] is passed to PHP's rename() function without validation. The vulnerable code accepts user input and applies no realpath() checks, basename() extraction, or directory traversal filtering before invoking rename(). An authenticated user can supply a path such as ../../../etc/passwd to move arbitrary server files to the content directory, making them web-accessible or overwriting application files. The attack requires a valid authenticated session (login is enforced via login() check), but the vulnerability has been disclosed publicly and a proof-of-concept is available. No vendor patch has been released despite early disclosure notification.
Affected products
- danpros HTMLy up to 3.1.1
Timeline
- 2026-06-10: disclosed: Vulnerability reported on GitHub
- 2026-08-03: advisory: CVE-2026-18645 published
- 2026: other: Vendor contacted early but did not respond