Executive Summary

CVE-2026-45233 is a path traversal vulnerability in HTMLy CMS version 3.1.1 that affects the autosave feature in the admin panel. It allows low-privileged authenticated attackers to manipulate the oldfile parameter by supplying directory traversal sequences (like "../"). This parameter is used directly in filesystem functions such as file_exists() and rename() without proper validation or path canonicalization.

Because the application does not restrict or sanitize these paths, attackers can relocate arbitrary files writable by the web server process to attacker-specified locations, potentially outside the intended directories.

This can lead to unauthorized file modifications, content corruption, or interference with other users' files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts including unauthorized relocation or modification of files writable by the web server process.

• Potential denial of service by corrupting or interfering with critical files.
• Corruption or loss of content managed by the CMS.
• Interference with other users' files or data integrity.

Overall, it poses a high risk to application integrity and availability.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying attempts to exploit the path traversal in the oldfile parameter at the /admin/autosave endpoint. Monitoring web server logs for requests containing directory traversal sequences such as "../" in the oldfile parameter can indicate exploitation attempts.

You can use commands to search your web server access logs for suspicious requests. For example, using grep on Linux systems:

• grep -i 'oldfile=.*\.\./' /var/log/apache2/access.log
• grep -i 'oldfile=.*\.\./' /var/log/nginx/access.log

Additionally, you can use intrusion detection systems or web application firewalls (WAFs) to detect and alert on such directory traversal patterns targeting the /admin/autosave endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /admin/autosave endpoint to trusted users only and applying input validation to sanitize the oldfile parameter.

Specifically, the application should be updated or patched to canonicalize file paths using functions like realpath(), enforce directory boundary restrictions, and validate file ownership before performing file operations.

If a patch is not yet available, consider implementing web application firewall rules to block requests containing directory traversal sequences (e.g., "../") in the oldfile parameter.

Also, review and restrict file permissions to minimize writable files by the web server process to reduce the impact of potential exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0