CVE-2026-18644

Name of the Vulnerable Software and Affected Versions danpros HTMLy versions prior to 3.1.2

Description A path traversal issue exists in the Delete Username Endpoint component within the /system/htmly.php file. The unlink() function fails to properly validate the File argument, allowing a remote attacker to manipulate the file path to delete arbitrary files on the system.

Recommendations Update danpros HTMLy to version 3.1.2 or later. As a temporary mitigation, restrict access to the /system/htmly.php endpoint.