Is there a public PoC exploit available for CVE-2026-18646?

Yes, a public proof-of-concept exploit is available for CVE-2026-18646. Prioritise patching immediately. EPSS: 0.5%.

HTMLy CVE-2026-18646

Q: What is the CVSS score of CVE-2026-18646?

CVE-2026-18646 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-52431 MEDIUM

Path Traversal (CWE-22)

2026-08-03 VulDB

GHSA-pq92-gfff-99hc

PHP Path Traversal Htmly Danpros

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated path traversal with read-only low-confidentiality impact; no integrity, availability, or scope-change consequence applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 03, 2026 - 21:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 03, 2026 - 21:09 vuln.today

CVE Published

Aug 03, 2026 - 20:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in danpros HTMLy up to version 3.1.1 allows remote unauthenticated attackers to read arbitrary files from the server filesystem by manipulating the Author Name argument in /system/htmly.php. A publicly available proof-of-concept exploit (E:P per CVSS 4.0 supplemental metric) exists at a referenced GitHub issue, materially lowering the exploitation bar. The vendor was unresponsive to responsible disclosure, leaving no vendor-confirmed patch and no official mitigation guidance.

Technical ContextAI

HTMLy is a flat-file blog CMS written in PHP that stores content in flat YAML/Markdown files rather than a relational database. The vulnerability resides in the Author Name Handler within /system/htmly.php, where user-supplied input to the Name argument is insufficiently sanitized before being used in a filesystem operation. This permits directory traversal sequences (e.g., ../../) to escape the intended file root, enabling reads of arbitrary files accessible to the web server process. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause class: the application fails to canonicalize or validate path components before use. The affected CPE is cpe:2.3:a:danpros:htmly:*:*:*:*:*:*:*:*, covering all HTMLy releases through 3.1.1.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. Administrators running HTMLy 3.1.1 or earlier should restrict public HTTP access to the /system/ directory path via web server rules (e.g., nginx deny or Apache Require all denied for /system/), noting this may impair administrative functionality and should be tested before deployment. Input validation or WAF rules blocking traversal sequences (../, ..\) in query parameters provide a detection and partial blocking layer, though WAF bypass is possible. File system permissions should be reviewed to ensure the web server process cannot read sensitive files outside the web root (e.g., /etc/passwd, application secrets). Given vendor non-responsiveness, migration to an actively maintained flat-file or database-backed CMS is the most durable long-term remediation. Monitor VulDB entry https://vuldb.com/vuln/385565 for any future patch release.