CVE-2026-18645 is a path traversal vulnerability in danpros HTMLy affecting versions 3.1.0 and 3.1.1. The issue resides in the add_content function within /system/admin/admin.php, where improper validation of the oldfile argument allows an attacker to perform directory traversal. This vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor was contacted but did not provide a response or patch. No official remediation or patch is currently available, and the exploit code has been publicly released.

Successful exploitation of this vulnerability allows an attacker to perform path traversal, potentially accessing or modifying files outside the intended directory scope. This can lead to unauthorized disclosure or modification of sensitive files. The attack can be initiated remotely and does not require user interaction, increasing the risk of exploitation. However, the vulnerability requires low privileges to exploit, which may limit the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected admin endpoint and monitor for suspicious activity. Applying compensating controls such as web application firewalls with path traversal protections may help mitigate risk until a patch is released.