CVE-2026-18646 | danpros HTMLy up to 3.1.1 Author Name /system/htmly.php path traversal

A vulnerability was found in danpros HTMLy up to 3.1.1 and classified as critical. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal.

The identification of this vulnerability is CVE-2026-18646. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More