EUVD-2026-39459
GHSA-mhrm-pq8h-qmf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged HTMLy account
-
DeliveryAccess admin autosave endpoint
-
ExploitSubmit oldfile with traversal sequences
-
Executionfile_exists()/rename() escape directory
-
PersistRelocate web-writable file
-
ImpactCorrupt content or disrupt availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged HTMLy account (PR:L) with access to the admin autosave endpoint in admin.php, and the ability to supply a crafted oldfile parameter containing directory traversal sequences. The target file must be writable by the web server process for rename() to succeed, which bounds what can actually be relocated. No user interaction and no special non-default configuration is required beyond a normal admin/author login being enabled; the limiting factors are the need for valid credentials and the web-server-writable constraint on candidate files. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N, base 7.2 High) is internally consistent with the description: network-reachable, low complexity, requires low privileges (an authenticated low-privileged account), no user interaction, and high integrity and availability impact with no confidentiality loss - appropriate for a file-relocation primitive that can corrupt or remove files but does not directly read them. Publicly available exploit code raises practical risk and lowers the bar for opportunistic use, but the PR:L requirement (a valid authenticated session) meaningfully limits exposure compared to an unauthenticated flaw. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation - the POC indicates capability, not in-the-wild use, and these signals should not be conflated. Net priority is moderate-to-high for any internet-exposed HTMLy instance that allows untrusted or low-tier accounts; lower where admin access is tightly restricted. |
| Exploit ScenarioDerived | A low-privileged author logs into an internet-facing HTMLy site and sends a crafted autosave request setting oldfile to a traversal path such as ../../config/something, causing rename() to move a sensitive or operational file out of place. Using the publicly available POC, the attacker corrupts site content or relocates files the web server can write, degrading integrity and availability of the CMS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Arbitrary file relocation in HTMLy CMS through version 3.1.1 allows low-privileged authenticated users to move any web-server-writable file by injecting directory traversal sequences into the oldfile parameter of the admin autosave endpoint. Reported by VulnCheck with publicly available exploit code, the flaw stems from passing unsanitized input directly to file_exists() and rename() in admin.php. It is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis despite the available POC.
RemediationAI
No vendor-released patch version is identified at time of analysis, so confirm the current fixed release directly with the maintainer via the project's GitHub (danpros/htmly) and the VulnCheck advisory at https://www.vulncheck.com/advisories/htmly-cms-path-traversal-via-oldfile-parameter-in-autosave before deploying. As compensating controls, restrict access to the /admin autosave endpoint at the web server or WAF layer and reject any oldfile parameter value containing ../, ..\, encoded traversal (%2e%2e), or absolute paths - note this can break legitimate draft saving if filtering is too aggressive. Reduce the number of low-privileged authored accounts and avoid granting authoring access to untrusted users, since exploitation requires authentication; this lowers convenience for multi-author sites. Where feas, run the web server process under a least-privilege account and tighten filesystem write permissions on the webroot so a successful rename() cannot reach sensitive files, accepting that overly strict permissions may interfere with HTMLy's flat-file content updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HTMLy (by danpros, CPE cpe:2.3:a:danpros:htmly) is a databaseless flat-file blogging CMS written in PHP that stores content as files on disk rather than in a database, making filesystem operations a core part of its admin workflow. The vulnerability is a classic CWE-22 Path Traversal: the autosave/draft feature in admin.php takes an oldfile parameter naming the file to be renamed to a draft location, but performs no canonicalization (e.g., realpath()) and no directory boundary check before handing the value to PHP's file_exists() and rename() calls. Because rename() operates with the privileges of the web server process and traversal sequences like ../ are honored by the underlying OS, an attacker can escape the intended content/drafts directory and relocate files anywhere the web server can write.
Know when Htmly gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Network endpoint with low complexity but requires an authenticated low-privileged account (PR:L); file relocation harms integrity and availability (I:H/A:H) without direct read access (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.
Articles & Coverage 1
Executive ViewAI
HTMLy CMS users face elevated operational risk from a file manipulation vulnerability (CVE-2026-45233) that allows authenticated users or compromised accounts to relocate critical files on the server, potentially enabling website defacement, configuration tampering, or data exposure. Publicly available exploit code exists, making this immediately actionable by threat actors. No vendor patch is available, requiring immediate defensive controls to manage ongoing risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce strict IP-based access controls limiting admin access to trusted networks; (2) Deploy WAF rules to block directory traversal sequences in request parameters; (3) Apply OS-level file permissions restricting write access to only required directories; (4) Implement file integrity monitoring to detect unauthorized file movements; (5) Isolate the CMS application on a segregated host with minimal network exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. Rated cr
A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or H
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scrip
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage
Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to admi
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a c
Path traversal in danpros HTMLy up to version 3.1.1 allows remote unauthenticated attackers to read arbitrary files from
A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profil
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. Rated medium severity (CVS
htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.
Path traversal in danpros HTMLy up to version 3.1.1 permits authenticated remote attackers to manipulate arbitrary file
Exploit-DB