CVE-2026-18645

Name of the Vulnerable Software and Affected Versions danpros HTMLy versions prior to 3.1.2

Description A path traversal flaw exists in the Admin Content Endpoint component. A remote attacker can manipulate the oldfile argument within the add content() function located in the /system/admin/admin.php file. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the add content() function in the /system/admin/admin.php file.