Description
A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-03
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Delete Username endpoint of danpros HTMLy, present up to version 3.1.1, allows attackers to manipulate the File argument of the unlink() function in htmly.php to perform a path traversal. This can result in the deletion of arbitrary files on the server, potentially removing user data and causing denial of service. The vulnerability is exploitable remotely and public exploits are available.

Affected Systems

All installations of danpros HTMLy running version 3.1.1 or earlier are affected. The path traversal flaw specifically targets the unlink function in the htmly.php component used for deleting usernames.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, but the vulnerability is publicly exploited and not listed in CISA's KEV catalog. An attacker can remotely trigger arbitrary file deletion by manipulating the File parameter in a request to /system/htmly.php, especially if the endpoint is accessible over the network. Due to the lack of a vendor patch notice the risk remains significant for unchanged systems.

Generated by OpenCVE AI on August 4, 2026 at 20:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest HTMLy release that addresses the path traversal flaw
  • If an upgrade is not immediately possible, limit external access to the Delete Username endpoint by configuring firewall rules or access control lists
  • Ensure the web server’s working directory and file permissions are restricted so that unlink() cannot delete critical system files

Generated by OpenCVE AI on August 4, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Danpros
Danpros htmly
Vendors & Products Danpros
Danpros htmly

Mon, 03 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal
First Time appeared Htmly
Htmly htmly
Weaknesses CWE-22
CPEs cpe:2.3:a:htmly:htmly:*:*:*:*:*:*:*:*
Vendors & Products Htmly
Htmly htmly
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Danpros Htmly
Htmly Htmly
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-03T20:28:48.788Z

Reserved: 2026-08-03T11:18:57.836Z

Link: CVE-2026-18644

cve-icon Vulnrichment

Updated: 2026-08-03T20:28:29.624Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T20:17:17.210

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-18644

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:00:11Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')