Is there a public PoC exploit available for EUVD-2026-52426?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52426. Prioritise patching immediately. EPSS: 0.4%.

HTMLy EUVD-2026-52426

Q: What is the CVSS score of EUVD-2026-52426?

EUVD-2026-52426 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-18645 LOW

Path Traversal (CWE-22)

2026-08-03 VulDB

GHSA-4pgp-58q4-x4mw

PHP Path Traversal Htmly Danpros

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable admin endpoint requires low-privilege authentication (PR:L); no confidentiality impact; partial integrity and availability effects consistent with constrained path traversal scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Aug 03, 2026 - 21:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 03, 2026 - 21:10 vuln.today

CVE Published

Aug 03, 2026 - 20:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in danpros HTMLy up to version 3.1.1 permits authenticated remote attackers to manipulate arbitrary file paths via the oldfile parameter in the Admin Content Endpoint (/system/admin/admin.php), enabling unauthorized file read or write operations outside intended directories. Exploitation requires low-privilege administrative access, and a public proof-of-concept exploit has been released on GitHub. The vendor was notified prior to disclosure but did not respond, meaning no patch has been issued.

Technical ContextAI

HTMLy is a PHP-based flat-file CMS/blogging platform by danpros where content is stored directly on the filesystem rather than a database - making path handling central to the application's core operations. The vulnerable function add_content in /system/admin/admin.php insufficiently sanitizes the oldfile argument, allowing CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) exploitation via directory traversal sequences such as ../ or URL-encoded equivalents. The CPE string cpe:2.3:a:danpros:htmly:*:*:*:*:*:*:*:* confirms all released versions through 3.1.1 are affected. Because HTMLy's flat-file architecture maps content management operations directly to filesystem paths, path traversal flaws carry elevated impact relative to database-backed CMSes.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fix version is available. As the primary compensating control, restrict access to the /system/admin/ directory to trusted IP addresses using web server access controls (e.g., nginx allow/deny directives or Apache Require ip blocks); this prevents remote exploitation but may impact legitimate remote administration workflows. Deploying a WAF rule to detect and block path traversal patterns (../, ..%2F, %2e%2e/, etc.) in the oldfile parameter of POST requests to admin.php provides an additional layer of mitigation, though complex encoding variations may require tuning. Consider whether the HTMLy admin interface needs to be internet-facing at all - placing it behind a VPN or bastion host eliminates network-layer exposure entirely. Monitor https://vuldb.com/vuln/385564 and https://github.com/orionyan520/cve_report/issues/6 for updates or a vendor-released fix.