CVE-2026-18644: HTMLy Path Traversal Vulnerability

CVE-2026-18644 Overview

CVE-2026-18644 is a path traversal vulnerability [CWE-22] affecting danpros HTMLy versions up to 3.1.1. The flaw resides in the unlink function within /system/htmly.php, part of the Delete Username Endpoint. Attackers can manipulate the File argument to traverse directories and delete files outside the intended scope. The attack is remotely exploitable and requires low-level authenticated access. A public exploit is available, though no in-the-wild exploitation has been confirmed. The vendor was contacted before disclosure but did not respond.

Critical Impact
Remote authenticated attackers can delete arbitrary files on the host filesystem by supplying traversal sequences to the Delete Username Endpoint.

Affected Products

danpros HTMLy versions up to and including 3.1.1
Component: Delete Username Endpoint (/system/htmly.php)
Affected function: unlink

Discovery Timeline

2026-08-03 - CVE-2026-18644 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18644

Vulnerability Analysis

The vulnerability exists in the unlink function inside /system/htmly.php, which handles user deletion in HTMLy. The endpoint accepts a File parameter that is passed to PHP's unlink() without adequate sanitization. Because the input is not normalized or restricted to a whitelisted directory, an authenticated attacker can inject path traversal sequences such as ../ to reference files outside the intended user data directory. The result is arbitrary file deletion on the underlying filesystem within the permissions of the web server process.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-22]. The File argument is trusted as-is when concatenated into a filesystem path. HTMLy does not validate that the resolved path remains within the expected user data directory, nor does it strip traversal metacharacters. See the GitHub Issue Report for reproduction details.

Attack Vector

An authenticated attacker with low privileges sends a crafted HTTP request to the Delete Username Endpoint. The File parameter contains directory traversal sequences pointing at a target file outside the user directory. HTMLy resolves the traversal and passes the attacker-controlled path to unlink(), deleting the file. Impact is limited to integrity and availability loss because the primitive is file deletion rather than read or write.

No verified proof-of-concept code is republished here. Technical details are available in the VulDB Vulnerability Details record.

Detection Methods for CVE-2026-18644

Indicators of Compromise

HTTP requests to /system/htmly.php containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the File parameter
Unexpected deletion of files owned by the web server user, particularly configuration files, content posts, or session data
Web server error logs indicating missing files immediately after Delete Username Endpoint access

Detection Strategies

Inspect web server access logs for POST or GET requests to the Delete Username Endpoint carrying suspicious File values
Deploy a web application firewall rule to flag path traversal patterns in HTMLy request parameters
Monitor filesystem audit logs for unlink operations originating from the PHP-FPM or Apache process on paths outside the HTMLy content directory

Monitoring Recommendations

Enable Linux auditd rules on the HTMLy installation directory to record delete operations with process attribution
Alert on authentication events for HTMLy user accounts followed by requests to /system/htmly.php
Track file integrity across /etc, HTMLy configuration files, and content directories using a file integrity monitoring tool

How to Mitigate CVE-2026-18644

Immediate Actions Required

Restrict access to HTMLy administrative endpoints to trusted IP ranges via reverse proxy or firewall rules
Audit HTMLy user accounts and remove low-privilege accounts that are not strictly required
Run HTMLy under a dedicated low-privilege system account with filesystem access limited to its content directory

Patch Information

At the time of publication, the vendor did not respond to disclosure attempts and no official patch is referenced in the NVD entry. Monitor the HTMLy GitHub repository and the VulDB CVE Record for updates. Until a fix is available, apply the workarounds below.

Workarounds

Deploy a WAF rule to reject requests to /system/htmly.php containing .., %2e%2e, or absolute path characters in the File parameter
Apply filesystem-level ACLs so the web server user cannot delete files outside the HTMLy content directory
Disable the Delete Username Endpoint in production if user deletion is not required, by removing or renaming the corresponding route in /system/htmly.php

bash

# Example ModSecurity rule to block traversal in the File parameter
SecRule REQUEST_URI "@contains /system/htmly.php" \
    "chain,phase:2,deny,status:403,id:1026184,\
    msg:'CVE-2026-18644 HTMLy path traversal attempt'"
    SecRule ARGS:File "@rx (\.\./|%2e%2e%2f|%2e%2e/|\.\.\\)" "t:none,t:urlDecodeUni"