CVE-2026-18646
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability was found in danpros HTMLy up to version 3.1.1 in the unknown code of file /system/htmly.php of the Author Name Handler component. Manipulation of the Name argument leads to path traversal. The attack can be launched remotely. The exploit is public. The vendor did not respond.
Risk Assessment
The risk is remote arbitrary file read, potentially leading to leakage of sensitive data such as configuration files or databases.
Recommendation
Update HTMLy to a patched version if available. Otherwise, apply temporary mitigations like input filtering.
Other vulnerabilities in danpros HTMLy
Original NVD description (English source)
A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS