HTMLy CMS versions up to 3.1.1 contain a path traversal flaw that allows an authenticated user with low privileges to supply traversal sequences in the "oldfile" parameter at the admin autosave endpoint. The server passes the unsanitized value directly to file_exists() and rename() functions, enabling the attacker to relocate any file that is writable by the web‑server process to an arbitrary draft location. This can be used to overwrite configuration files, sensitive documents, or other files in the web root, potentially exposing or tampering with data.

Vendor Danpros – HTMLy CMS – version 3.1.1.

The CVSS score of 7.2 indicates a medium‑high risk, and the vulnerability is not listed in CISA KEV. The exploit requires authentication but not privileged user rights, and the attack vector is likely over the web interface, as the vulnerable parameter is exposed in an admin endpoint. Without a patch, attackers could move or replace any writable file on the host, leading to data leakage or corruption.