CVE-2026-18644
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker can read or delete arbitrary files on the server, compromising data confidentiality and integrity, and potentially gaining control over the system.
Recommendation
Update HTMLy to the latest available version or apply appropriate security patches immediately.
Other vulnerabilities in HTMLy
Original NVD description (English source)
A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS