Executive brief
HTMLy is a flat-file content management system used for blogging without a database. A vulnerability in the author profile route allows unauthenticated attackers to probe arbitrary files on the server by manipulating the author name parameter, potentially exposing sensitive configuration files, user accounts, and the server's filesystem structure.
Technical details
A path traversal vulnerability (CWE-22) exists in the /author/:name route handler within /system/htmly.php (lines 300–312). The $name URL parameter is concatenated directly into two filesystem paths—config/users/$name.ini and $vroot/layout--profile--$name.html.php—without sanitization; the strtolower() function applied does not block ../ sequences. Unauthenticated attackers can inject path traversal sequences (e.g., ..%2F..%2F..%2F) to probe arbitrary file existence on the server via differential HTTP responses (200 vs 404). Although the .ini and .html.php suffixes limit direct file reading, attackers can enumerate the filesystem structure, verify existence of sensitive files (e.g., config files, logs), and identify user accounts. The route is publicly accessible and requires no authentication or user interaction.
Affected products
- danpros HTMLy up to 3.1.1
Timeline
- 2026-06-10: disclosed: Vulnerability reported on GitHub
- 2026-08-03: advisory: Published on NVD