Which versions of HTMLy CMS are affected by CVE-2026-45233?

HTMLy CMS users face elevated operational risk from a file manipulation vulnerability (CVE-2026-45233) that allows authenticated users or compromised accounts to relocate critical files on the…

Is there a public PoC exploit available for CVE-2026-45233?

Yes, a public proof-of-concept exploit is available for CVE-2026-45233. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-45233?

WITHIN 24 HOURS: Identify all systems running HTMLy CMS through version 3.1.1; restrict administrative access to VPN/trusted networks only; review recent file system activity for suspicious file relocations. WITHIN 7 DAYS: Deploy Web Application Firewall (WAF) rules to block directory traversal patterns (../, ..\ sequences) in the admin endpoints; apply restrictive file-system permissions to limit write access in web-writable directories. WITHIN 30 DAYS: Evaluate and plan migration to alternative CMS platforms; implement continuous file integrity monitoring (FIM) on web-accessible directories.

HTMLy CMS CVE-2026-45233

Q: What is the CVSS score of CVE-2026-45233?

CVE-2026-45233 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-39459 HIGH

Path Traversal (CWE-22)

2026-06-25 VulnCheck

GHSA-mhrm-pq8h-qmf3

PHP Path Traversal Htmly Danpros

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network endpoint with low complexity but requires an authenticated low-privileged account (PR:L); file relocation harms integrity and availability (I:H/A:H) without direct read access (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 17:16 vuln.today

DescriptionCVE.org

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.

Articles & Coverage 1

News 3 New PHP Vulnerabilities - 3 High Severity, 1 With POC Jun 26, 2026

AnalysisAI

Arbitrary file relocation in HTMLy CMS through version 3.1.1 allows low-privileged authenticated users to move any web-server-writable file by injecting directory traversal sequences into the oldfile parameter of the admin autosave endpoint. Reported by VulnCheck with publicly available exploit code, the flaw stems from passing unsanitized input directly to file_exists() and rename() in admin.php. It is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis despite the available POC.

Technical ContextAI

HTMLy (by danpros, CPE cpe:2.3:a:danpros:htmly) is a databaseless flat-file blogging CMS written in PHP that stores content as files on disk rather than in a database, making filesystem operations a core part of its admin workflow. The vulnerability is a classic CWE-22 Path Traversal: the autosave/draft feature in admin.php takes an oldfile parameter naming the file to be renamed to a draft location, but performs no canonicalization (e.g., realpath()) and no directory boundary check before handing the value to PHP's file_exists() and rename() calls. Because rename() operates with the privileges of the web server process and traversal sequences like ../ are honored by the underlying OS, an attacker can escape the intended content/drafts directory and relocate files anywhere the web server can write.

RemediationAI

No vendor-released patch version is identified at time of analysis, so confirm the current fixed release directly with the maintainer via the project's GitHub (danpros/htmly) and the VulnCheck advisory at https://www.vulncheck.com/advisories/htmly-cms-path-traversal-via-oldfile-parameter-in-autosave before deploying. As compensating controls, restrict access to the /admin autosave endpoint at the web server or WAF layer and reject any oldfile parameter value containing ../, ..\, encoded traversal (%2e%2e), or absolute paths - note this can break legitimate draft saving if filtering is too aggressive. Reduce the number of low-privileged authored accounts and avoid granting authoring access to untrusted users, since exploitation requires authentication; this lowers convenience for multi-author sites. Where feas, run the web server process under a least-privilege account and tighten filesystem write permissions on the webroot so a successful rename() cannot reach sensitive files, accepting that overly strict permissions may interfere with HTMLy's flat-file content updates.