CVE-2026-45233: HTMLy CMS Path Traversal Vulnerability (File Relocation)

Technical summary

The vulnerability resides in admin.php's autosave endpoint, where the 'oldfile' parameter is passed directly to file_exists() and rename() functions without path canonicalization, validation, or directory boundary checks. An authenticated attacker can supply directory traversal sequences (e.g., '../../../') to escape intended storage boundaries and move arbitrary files writable by the web server process to attacker-controlled draft locations. The absence of realpath() normalization or base-path enforcement allows traversal of the entire filesystem scope accessible to the web process, enabling arbitrary file relocation rather than just deletion or overwrite.

Business impact

A compromised account—whether from credential stuffing, phishing, or insider threat—becomes a vector for file manipulation attacks. An attacker could relocate configuration files containing database credentials, move PHP files into web roots, or displace critical application files, leading to authentication bypass, data exfiltration, or denial of service. For organizations running HTMLy as a content platform or documentation hub, this creates a path to secondary compromise and lateral movement, particularly if the web server process runs with elevated permissions.

Affected systems

HTMLy CMS through version 3.1.1 is affected. The vulnerability requires authentication, so only installations with user accounts are directly exploitable. Exposure is highest in multi-user or open-registration deployments where account compromise is a realistic threat model.

Exploitability

Exploitation requires valid authentication credentials and low privilege level—no admin role is mandated by the description. The attack surface is the admin autosave endpoint, which is accessible over the network without special network positioning (CVSS AV:N). No user interaction is needed; the attacker directly submits a malicious request. The relatively low barrier to entry, combined with the absence of input validation, makes this a practical risk for any deployment where user account security cannot be guaranteed.

Remediation

Upgrade HTMLy CMS to a patched version released after 3.1.1. Verify against the vendor's official advisory for the exact minimum version that addresses this flaw. Until patching is possible, restrict access to the admin panel using firewall rules, WAF policies, or authentication proxies to limit who can reach the vulnerable endpoint. Review access logs and user account activity for signs of credential compromise or suspicious file operations.

Patch guidance

Consult the official HTMLy project repository or security advisories for a release version newer than 3.1.1 that includes a fix. The patch should include input validation and path canonicalization on the oldfile parameter—verify that any release notes mention path traversal or CWE-22 fixes before deploying. Test the patched version in a non-production environment to confirm autosave functionality remains intact and that file paths are properly restricted to their intended storage directories.

Detection guidance

Monitor admin.php autosave endpoint requests for URL-encoded or literal traversal sequences ('../', '..\', unicode variants) in POST or GET parameters, particularly the oldfile field. Log file operations initiated by the web server process—sudden moves or renames of files outside expected directories merit investigation. Track failed file_exists() or rename() calls that reference paths outside the CMS installation root. Correlate suspicious file operations with authenticated user sessions to identify compromised accounts.

Why prioritize this

This vulnerability scores HIGH (CVSS 8.1) due to high integrity and availability impact combined with network accessibility and low attack complexity. Although authentication is required, the low privilege threshold and lack of admin role requirement broaden the threat model. File manipulation can cascade into more severe attacks (code execution via relocated PHP, credential theft via moved config files). Organizations should prioritize this after critical remote code execution flaws but before low-impact vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network-accessible admin endpoint (AV:N), (2) Low attack complexity with no special conditions needed (AC:L), (3) Requirement for low-privilege authentication (PR:L), (4) No user interaction (UI:N), (5) Scope unchanged to the vulnerable component (S:U), (6) No confidentiality impact from the file move itself (C:N), (7) High integrity impact from uncontrolled file relocation (I:H), and (8) High availability impact from potential file displacement or system disruption (A:H). The score appropriately penalizes the combination of persistent access risk and broad exploitation surface.

Frequently asked questions