CVE-2026-18645: HTMLy Path Traversal Vulnerability

CVE-2026-18645 Overview

CVE-2026-18645 is a path traversal vulnerability [CWE-22] in danpros HTMLy through version 3.1.1. The flaw resides in the add_content function of /system/admin/admin.php, part of the Admin Content Endpoint component. An authenticated attacker can manipulate the oldfile argument to traverse directories and access files outside the intended scope. The attack is initiated remotely over the network and requires low-privilege access. Public exploit details have been released. The vendor was contacted before disclosure but did not respond.

Critical Impact
Authenticated remote attackers can perform path traversal against HTMLy administrative endpoints, leading to unauthorized file manipulation and limited integrity and availability impact.

Affected Products

danpros HTMLy versions up to and including 3.1.1
Component: Admin Content Endpoint (/system/admin/admin.php)
Function: add_content

Discovery Timeline

2026-08-03 - CVE-2026-18645 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18645

Vulnerability Analysis

The vulnerability exists in the add_content function of /system/admin/admin.php in HTMLy, a flat-file blogging platform. The function accepts an oldfile parameter that is used in file operations without adequate sanitization. Attackers with low-privilege authenticated access can supply traversal sequences such as ../ in the oldfile argument to reach files outside the intended content directory.

Because HTMLy stores posts and configuration as flat files, path traversal in administrative content handlers can affect site content and metadata. Public exploit disclosure increases the likelihood of opportunistic scanning against exposed HTMLy instances.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The add_content function does not normalize or validate the oldfile argument before using it in file system operations. User-controlled input flows directly into file path construction without canonicalization or allowlist checks.

Attack Vector

Exploitation occurs remotely over HTTP against the HTMLy admin interface. The attacker must hold valid low-privilege credentials to reach the Admin Content Endpoint. Once authenticated, the attacker submits a crafted oldfile parameter containing directory traversal sequences to the add_content handler. The server processes the manipulated path, resulting in file operations against attacker-selected locations.

See the GitHub Issue Report and VulDB CVE Details for public technical write-ups.

Detection Methods for CVE-2026-18645

Indicators of Compromise

HTTP POST requests to /system/admin/admin.php containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the oldfile parameter
Unexpected modifications to files outside the HTMLy content directory, such as configuration or template files
Admin session activity from unusual source IPs interacting with the content management endpoints

Detection Strategies

Inspect web server access logs for requests to admin.php with suspicious oldfile values containing path separators or traversal patterns
Deploy web application firewall (WAF) rules that flag path traversal payloads in POST parameters targeting HTMLy admin routes
Monitor file integrity across the HTMLy installation directory to identify writes to unexpected paths

Monitoring Recommendations

Alert on authentication events for HTMLy admin accounts originating from atypical geolocations or IP ranges
Correlate admin login events with subsequent traversal-style requests within the same session
Track process-level file writes performed by the PHP interpreter servicing HTMLy to detect out-of-scope modifications

How to Mitigate CVE-2026-18645

Immediate Actions Required

Restrict access to the HTMLy admin interface using IP allowlists or network-level controls until a patch is available
Rotate credentials for all HTMLy administrative accounts and enforce strong, unique passwords
Audit the HTMLy installation directory for unauthorized file modifications and restore from known-good backups if tampering is detected

Patch Information

No vendor patch is currently available. The vendor did not respond to disclosure attempts according to the VulDB Vulnerability Overview. Monitor the HTMLy project repository for future security updates.

Workarounds

Place the HTMLy admin path behind an authenticated reverse proxy that enforces additional access controls
Configure web server rules to reject requests containing ../ or encoded traversal sequences in POST bodies targeting admin.php
Run the HTMLy process under a least-privilege user account with file system permissions restricted to the intended content directory

bash

# Example nginx rule to block traversal patterns targeting HTMLy admin
location ~ ^/system/admin/admin\.php$ {
    if ($args ~* "\.\./|%2e%2e%2f") { return 403; }
    if ($request_body ~* "oldfile=[^&]*(\.\./|%2e%2e%2f)") { return 403; }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}