CVE-2026-18646

Received Received - Intake

Path Traversal in HTMLy CMS via Author Name Parameter

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-18646

EUVD

EUVD-2026-52431

Affected Vendors & Products

Vendor	Product	Version / Range
danpros	htmly	to 3.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in danpros HTMLy up to version 3.1.1. It exists in the Author Name Handler component, specifically in the /system/htmly.php file. An attacker can manipulate the Name argument to perform path traversal, potentially accessing unauthorized files or directories. The exploit is publicly available and can be launched remotely.

Detection Guidance

This vulnerability involves path traversal in danpros HTMLy up to 3.1.1 via the Author Name Handler. Check for unusual file access patterns or requests to /system/htmly.php with manipulated Name arguments. Review web server logs for suspicious paths or encoded sequences like ../. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to access sensitive files on the server by manipulating the Name argument. This may lead to unauthorized data disclosure, file manipulation, or further attacks on the system. The impact depends on the server's configuration and the files accessible via path traversal.

Compliance Impact

This vulnerability allows path traversal via manipulation of the Author Name argument, which could expose sensitive files or data. This may impact compliance with GDPR (data exposure risks) and HIPAA (unauthorized access to protected health information) if exploited.

Mitigation Strategies

Immediately update danpros HTMLy to the latest version beyond 3.1.1 if available. If no update is available, consider disabling or removing the software until a patch is released. Monitor network traffic for unusual path traversal attempts in the /system/htmly.php file.

Hi! I’m here to help you understand CVE-2026-18646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70