CVE-2026-18646: HTMLy Path Traversal Vulnerability

CVE-2026-18646 Overview

CVE-2026-18646 is a path traversal vulnerability [CWE-22] affecting danpros HTMLy versions up to and including 3.1.1. The flaw resides in the Author Name Handler component within /system/htmly.php. Attackers can manipulate the Name argument to traverse the filesystem outside the intended directory. The vulnerability is exploitable remotely and requires no authentication or user interaction. Public exploit details have been disclosed, and the vendor did not respond to early disclosure attempts.

Critical Impact
Unauthenticated remote attackers can manipulate the Name parameter in the Author Name Handler to access files outside the intended directory scope.

Affected Products

danpros HTMLy versions up to 3.1.1
Component: Author Name Handler in /system/htmly.php
No vendor patch available at time of disclosure

Discovery Timeline

2026-08-03 - CVE-2026-18646 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18646

Vulnerability Analysis

The vulnerability affects the Author Name Handler in /system/htmly.php within HTMLy, a databaseless flat-file blogging platform written in PHP. The handler processes the Name argument without adequate sanitization of directory traversal sequences. An attacker can inject sequences such as ../ to escape the intended author directory and reference files elsewhere on the filesystem.

The attack is executed over the network without prior authentication and requires no user interaction. Because HTMLy stores content as flat files rather than in a database, filesystem access is central to application logic, which increases the exposure surface for path traversal flaws.

According to the disclosure, the vendor was contacted but did not respond. Public exploit information is available through the GitHub Issue Report and VulDB Vulnerability Entry.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The Author Name Handler accepts user-controlled input via the Name parameter and uses it to construct filesystem paths without normalizing or validating traversal sequences. Input containing ../ or similar constructs is not stripped or rejected before the path is resolved.

Attack Vector

An attacker sends a crafted request containing directory traversal sequences in the Name argument to the vulnerable endpoint in /system/htmly.php. The server resolves the manipulated path and processes files outside the intended author directory. The attack requires only network reachability to the HTMLy instance.

No verified proof-of-concept code is republished here. Refer to the GitHub Issue Report for technical exploitation details.

Detection Methods for CVE-2026-18646

Indicators of Compromise

HTTP requests to /system/htmly.php containing ../ or URL-encoded traversal sequences (%2e%2e%2f, ..%2f) in the Name parameter
Access log entries referencing the Author Name Handler with abnormally long or path-like Name values
Web server file reads originating from the HTMLy process against paths outside the application root

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Name parameter for encoded and plain directory traversal patterns
Correlate HTMLy access logs with filesystem audit events on the web server to identify unexpected read operations
Monitor for enumeration patterns targeting common sensitive files such as /etc/passwd, PHP configuration files, or HTMLy user data files

Monitoring Recommendations

Enable verbose logging in the web server and PHP-FPM to capture full request URIs and parameters
Alert on repeated 4xx or 5xx responses from /system/htmly.php that may indicate probing activity
Track outbound anomalies or subsequent authenticated actions following suspicious traversal requests

How to Mitigate CVE-2026-18646

Immediate Actions Required

Restrict network access to HTMLy administrative endpoints using firewall rules or reverse proxy allowlists
Deploy WAF signatures that block path traversal patterns targeting /system/htmly.php and the Name parameter
Audit the HTMLy installation directory permissions to enforce least privilege for the web server user
Review historical web server logs for prior exploitation attempts referencing the vulnerable handler

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to disclosure. Users of HTMLy 3.1.1 and earlier should monitor the HTMLy GitHub repository for security updates and consult the VulDB CVE Details entry for status changes.

Workarounds

Place the HTMLy application behind an authenticating reverse proxy to prevent unauthenticated access
Configure web server rewrite rules to reject requests containing .., %2e%2e, or null byte sequences in query parameters
Isolate the HTMLy process with filesystem confinement such as chroot, containers, or AppArmor/SELinux profiles restricting read scope to the application directory
Consider migrating to an alternative content management platform until a fix is released

bash

# Example nginx configuration to block traversal in the Name parameter
location /system/htmly.php {
    if ($arg_name ~* "(\.\./|%2e%2e|\.\.\\)") {
        return 403;
    }
}