HTMLy CVE-2026-18644

Q: What is the CVSS score of CVE-2026-18644?

CVE-2026-18644 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52424 LOW

Path Traversal (CWE-22)

2026-08-03 cna@vuldb.com

GHSA-g2qx-6r2x-hr8v

PHP Path Traversal

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable endpoint requires a low-privilege session (PR:L); file deletion yields limited integrity and availability impact with zero confidentiality exposure, and scope is contained to the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 20:39 vuln.today

DescriptionCVE.org

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in danpros HTMLy up to version 3.1.1 enables remote authenticated attackers to delete arbitrary files via the Delete Username endpoint. The PHP unlink() function in /system/htmly.php accepts a user-controlled File argument without path sanitization, allowing traversal outside the intended directory. A public proof-of-concept exploit exists (CVSS 4.0 E:P); no vendor patch is available as the vendor was unresponsive to disclosure, leaving installations permanently exposed without manual mitigation.

Technical ContextAI

HTMLy is a PHP-based flat-file CMS by danpros that stores content and configuration in filesystem files rather than a relational database. The vulnerability resides in /system/htmly.php, specifically within the Delete Username functionality, where PHP's native unlink() function is invoked with a caller-supplied File argument. Absence of input sanitization or path canonicalization allows an attacker to inject ../ sequences, escaping the intended user-directory boundary and targeting arbitrary files accessible to the web server process - a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw. Because HTMLy uses flat files for users, posts, and configuration, targeted deletion of these files can degrade or fully disable application functionality. The CVSS 4.0 vector AV:N/AC:L/AT:N confirms the exploit path is network-reachable with no special technical preconditions beyond a valid session.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure and no fixed version is referenced in any available source. As an immediate compensating control, restrict access to the Delete Username endpoint at the web server or reverse-proxy layer so only trusted administrator accounts can reach /system/htmly.php; this eliminates the attack surface for low-privilege users while preserving admin functionality. Additionally, harden the web server process user's filesystem permissions so it can only write and delete within the HTMLy data directory, limiting the blast radius of any traversal. Deploying a WAF rule to reject requests containing ../ or URL-encoded traversal sequences (%2e%2e) in the File parameter provides a detection and blocking layer with minimal side effects. Organizations that need a fix should consider patching the source directly by canonicalizing the File argument with PHP's realpath() and validating the resolved path is within an expected base directory before calling unlink(). Monitor VulDB entry https://vuldb.com/vuln/385563 for any future vendor response.