CVE-2026-18646: danpros HTMLy Author Name htmly.php path traversal
A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18646?
CVE-2026-18646 has a medium severity rating of 5.3.
How does CVE-2026-18646 affect danpros HTMLy?
CVE-2026-18646 affects the Author Name Handler in the htmly.php file, allowing for path traversal through argument manipulation.
What could an attacker do with CVE-2026-18646?
An attacker could exploit CVE-2026-18646 to perform path traversal attacks remotely.
What versions of danpros HTMLy are affected by CVE-2026-18646?
CVE-2026-18646 affects danpros HTMLy versions up to 3.1.1.
What mitigation steps can be taken for CVE-2026-18646?
To mitigate CVE-2026-18646, it is recommended to update danpros HTMLy to the latest version or apply patches that address the path traversal vulnerability.