Executive brief
HTMLy, a flat-file content management system, contains a security flaw in its image content creation feature. An attacker with a low-privileged account can inject malicious code into a post that triggers when an administrator views it. This allows the attacker to silently hijack the administrator's session, change their password, and take full control of the website.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 at the '/add/content?type=image' endpoint. The application fails to sanitize user input in the content field, allowing an authenticated low-privileged user to inject a malicious payload. When an administrator views the crafted post, the JavaScript executes in their session context. The exploit can programmatically retrieve the administrator's CSRF token from the password change page and submit a POST request to modify the administrator's credentials, resulting in a complete account takeover. No official patch is currently noted in the advisory, though the vulnerability is publicly disclosed with a proof-of-concept.
Affected products
- danpros HTMLy 3.1.1
Timeline
- 2026-04-28: disclosed: Initial disclosure and CVE assignment
- 2026-04-28: advisory