HTMLy CVE-2026-18645

Exploitation requires valid credentials to the HTMLy administrative interface, confirmed by PR:L in the CVSS 4.0 vector - unauthenticated attackers cannot directly exploit this flaw. The vulnerable code path is specifically the add_content function triggered via the Admin Content Endpoint at /system/admin/admin.php, activated by manipulating the oldfile argument. The attack is network-accessible (AV:N) with no special attack conditions required (AT:N). Limiting factors: (1) authentication to the admin panel is mandatory, meaning exposed but credential-protected admin interfaces reduce opportunistic risk; (2) no confidentiality impact is reflected in the CVSS metrics (VC:N), indicating the traversal primarily enables file write or displacement rather than arbitrary file read; (3) the vulnerability applies to the admin content management workflow specifically, not a general endpoint. Default HTMLy installations with strong admin credentials and non-internet-exposed admin panels face substantially lower real-world risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) establishes that this is network-exploitable with low complexity and no special attack conditions, but requires low-privilege authentication - limiting opportunistic unauthenticated mass exploitation. Impact is constrained: VI:L and VA:L indicate partial integrity and availability effects with no confidentiality exposure (VC:N), suggesting limited file manipulation rather than full system compromise or data exfiltration. The E:P modifier in the CVSS 4.0 vector confirms a publicly available proof-of-concept, which meaningfully increases real-world exploitation likelihood for exposed admin panels. No CISA KEV listing exists, and no EPSS score was provided in the input - exploitation probability cannot be quantified beyond POC availability. The absence of a vendor patch is a significant compounding factor: no remediation timeline exists. Real-world risk is moderate for any internet-exposed HTMLy instance with accessible admin credentials.

An attacker who has obtained low-privilege credentials to the HTMLy admin panel - through credential stuffing, phishing, or weak default passwords - submits a crafted HTTP POST request to /system/admin/admin.php with the oldfile parameter set to a traversal payload (e.g., ../../config/config.ini), redirecting the add_content function to operate on files outside the intended content directory. With a public exploit already available on GitHub, this attack requires minimal technical sophistication and can be executed by script-level actors.