CVE-2024-34191

Name of the Vulnerable Software and Affected Versions htmly version 2.9.6

Description The issue allows attackers to delete arbitrary files by sending a crafted request to the admin.php endpoint, specifically via the delete post() function.

Recommendations For version 2.9.6, consider restricting access to the delete post() function in the admin.php endpoint until a patch is available. As a temporary workaround, avoid using the delete post() function to minimize the risk of exploitation.