CVE-2026-18645

MediumCVSS 5.4

Published: 03/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 04/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

45th percentile - higher than 45% of all known CVEs

Summary

A vulnerability was found in danpros HTMLy up to version 3.1.1 in the add_content function of file /system/admin/admin.php of the Admin Content Endpoint component. Manipulation of the oldfile argument leads to path traversal. The attack can be launched remotely. The exploit is public. The vendor did not respond.

Risk Assessment

The risk is remote arbitrary file read or write, potentially leading to data leakage or system compromise.

Recommendation

Update HTMLy to a patched version if available. Otherwise, restrict admin panel access and apply input filtering.

Other vulnerabilities in danpros HTMLy

CVE-2026-18646Medium
A vulnerability was found in danpros HTMLy up to version 3.1.1 in the unknown code of file /system/htmly.php of the Author Name Handler component. Manipulation of the Name argument leads to path traversal. The attack can be launched remotely. The exploit is public. The vendor did not respond.

Original NVD description (English source)

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS