CVE-2026-18644 is a path traversal vulnerability affecting danpros HTMLy versions 3.1.0 and 3.1.1. The issue resides in the unlink function within the /system/htmly.php file's Delete Username Endpoint, where improper validation of the File argument allows attackers to traverse directories and potentially delete arbitrary files. The vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The vendor has not issued any fix or advisory, and no official remediation level is assigned. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform path traversal via the File argument, potentially leading to deletion of arbitrary files on the server. This could result in denial of service or unauthorized file manipulation. The vulnerability requires low privileges and no user interaction, increasing its risk. However, no confirmed exploitation in the wild has been reported to date.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates. Until a fix is released, restrict access to the vulnerable endpoint if possible and apply compensating controls such as web application firewalls to detect and block path traversal attempts. Review and limit file system permissions to minimize potential damage from exploitation.