EUVD-2026-52431
GHSA-pq92-gfff-99hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /system/htmly.php
-
DeliveryInject traversal sequences in Name parameter
-
ExploitEscape intended web root directory
-
ExecutionRead arbitrary files accessible to web process
-
ImpactExfiltrate credentials or sensitive configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation - the CVSS 4.0 vector confirms network-accessible (AV:N), low-complexity (AC:L), no-attack-requirements (AT:N), unauthenticated (PR:N), no-user-interaction (UI:N) exploitation against default HTMLy deployments up to version 3.1.1. Any instance of HTMLy with /system/htmly.php reachable over HTTP or HTTPS is a viable target. Exploitation is limited to file read operations (VC:L) on the vulnerable system; the attacker can only read files accessible to the web server process user, so the extent of disclosure depends on filesystem permissions and what sensitive data resides on the host. No write or code execution capability is indicated by this vector. |
| Impact | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) presents a worst-case accessibility profile - unauthenticated, low-complexity, network-reachable with no attack requirements - making any internet-exposed HTMLy instance a trivially reachable target. However, impact is bounded: VC:L with VI:N/VA:N/SC:N/SI:N/SA:N indicates file read capability only, with no integrity, availability, or cross-system impact confirmed. This is meaningfully less severe than code execution. The E:P supplemental metric confirms a public POC exists, which elevates practical risk beyond the base score alone. No EPSS score or CISA KEV listing is present in the source data - exploitation is not confirmed as active, only possible. The vendor's non-response to disclosure removes the possibility of coordinated remediation, leaving users without official guidance. Real-world risk is moderate for exposed instances: file reads can expose credentials, configuration secrets, or private content stored on the server, even without full compromise. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to a publicly exposed HTMLy instance at /system/htmly.php, injecting path traversal sequences (e.g., ../../etc/passwd or ../../config.yaml) into the Name parameter. The server resolves the path outside the web root and returns the contents of sensitive files - potentially including application credentials, API keys, or system user data - readable by the web server process. A public POC at https://github.com/orionyan520/cve_report/issues/7 means this attack is replicable without technical sophistication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Path traversal in danpros HTMLy up to version 3.1.1 allows remote unauthenticated attackers to read arbitrary files from the server filesystem by manipulating the Author Name argument in /system/htmly.php. A publicly available proof-of-concept exploit (E:P per CVSS 4.0 supplemental metric) exists at a referenced GitHub issue, materially lowering the exploitation bar. The vendor was unresponsive to responsible disclosure, leaving no vendor-confirmed patch and no official mitigation guidance.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. Administrators running HTMLy 3.1.1 or earlier should restrict public HTTP access to the /system/ directory path via web server rules (e.g., nginx deny or Apache Require all denied for /system/), noting this may impair administrative functionality and should be tested before deployment. Input validation or WAF rules blocking traversal sequences (../, ..\) in query parameters provide a detection and partial blocking layer, though WAF bypass is possible. File system permissions should be reviewed to ensure the web server process cannot read sensitive files outside the web root (e.g., /etc/passwd, application secrets). Given vendor non-responsiveness, migration to an actively maintained flat-file or database-backed CMS is the most durable long-term remediation. Monitor VulDB entry https://vuldb.com/vuln/385565 for any future patch release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HTMLy is a flat-file blog CMS written in PHP that stores content in flat YAML/Markdown files rather than a relational database. The vulnerability resides in the Author Name Handler within /system/htmly.php, where user-supplied input to the Name argument is insufficiently sanitized before being used in a filesystem operation. This permits directory traversal sequences (e.g., ../../) to escape the intended file root, enabling reads of arbitrary files accessible to the web server process. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause class: the application fails to canonicalize or validate path components before use. The affected CPE is cpe:2.3:a:danpros:htmly:*:*:*:*:*:*:*:*, covering all HTMLy releases through 3.1.1.
Know when Htmly gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable unauthenticated path traversal with read-only low-confidentiality impact; no integrity, availability, or scope-change consequence applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. Rated cr
Arbitrary file relocation in HTMLy CMS through version 3.1.1 allows low-privileged authenticated users to move any web-s
A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or H
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scrip
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage
Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to admi
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a c
A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profil
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. Rated medium severity (CVS
htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.
Path traversal in danpros HTMLy up to version 3.1.1 permits authenticated remote attackers to manipulate arbitrary file
Exploit-DB