Description
A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-03
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a path‑traversal bug triggered by manipulating the oldfile argument in the add_content function of danpros HTMLy’s Admin Content Endpoint. Exploitation allows an attacker to read arbitrary files on the host, potentially exposing configuration files, sensitive data, or revealing system credentials. The vulnerability is defined by CWE‑22 and is typically exploited from an external network, resulting in confidentiality loss.

Affected Systems

danpros HTMLy versions up to and including 3.1.1 are affected, specifically the Admin Content Endpoint component located in /system/admin/admin.php.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS information is available and the vulnerability is not listed in the CISA KEV catalog, yet the exploit code has already been released publicly. Because the attack can be initiated remotely and no vendor fix is currently available, the risk is tangible for organizations running vulnerable instances. Employing network controls or awaiting an official patch should be prioritized.

Generated by OpenCVE AI on August 4, 2026 at 09:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict remote access to the admin.php endpoint by placing it behind a firewall or IP‑whitelist.
  • Monitor web‑server logs for requests containing the oldfile parameter or suspicious request patterns to detect potential abuse.
  • Remove or disable the Admin Content Endpoint module if it is not required for business operations.
  • Apply any upstream patch or upgrade to a version newer than 3.1.1 as soon as it is announced.

Generated by OpenCVE AI on August 4, 2026 at 09:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Danpros
Danpros htmly
Vendors & Products Danpros
Danpros htmly

Mon, 03 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title danpros HTMLy Admin Content Endpoint admin.php add_content path traversal
First Time appeared Htmly
Htmly htmly
Weaknesses CWE-22
CPEs cpe:2.3:a:htmly:htmly:*:*:*:*:*:*:*:*
Vendors & Products Htmly
Htmly htmly
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Danpros Htmly
Htmly Htmly
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T17:11:27.157Z

Reserved: 2026-08-03T11:19:02.413Z

Link: CVE-2026-18645

cve-icon Vulnrichment

Updated: 2026-08-04T17:11:17.687Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T21:16:37.283

Modified: 2026-08-12T20:59:00.027

Link: CVE-2026-18645

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T10:00:04Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')