CVE-2026-18644 Details

A path traversal vulnerability has been identified in danpros HTMLy versions through 3.1.1. The issue arises in the Delete Username Endpoint within the file /system/htmly.php. The vulnerability allows authenticated administrators to delete arbitrary files on the server by manipulating the file parameter in a POST request. This is achieved by exploiting the lack of proper validation on the file path before it is passed to the unlink() function, enabling the deletion of files accessible to the PHP process. The vulnerability could lead to application denial of service, data loss, or further exploitation.

To address this vulnerability, implement path validation by using realpath() to ensure the file remains within the intended directory before deletion. Additionally, use basename() to extract only the filename, preventing directory traversal. Consider establishing a whitelist of allowed directories for file deletion and apply the principle of least privilege by running the PHP process with minimal filesystem permissions.