CVE-2026-45233: Danpros Htmly

High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days.

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.

Affected products

• Danpros Htmly: up to and including 3.1.1

Published 2026-06-25. Last modified 2026-07-14.