This vulnerability in danpros HTMLy up to version 3.1.1 involves improper validation of the oldfile argument in the add_content function within /system/admin/admin.php. An attacker can exploit this flaw remotely to perform path traversal, potentially accessing or modifying files outside the intended directory scope. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Public exploit code is available, but the vendor has not issued any fix or advisory.

Successful exploitation allows an attacker to perform path traversal remotely, which can lead to unauthorized access or modification of files on the server hosting HTMLy. This could compromise the integrity or confidentiality of the system depending on the files accessed. However, the vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor, as they have not responded to disclosure attempts. Users should monitor vendor channels for updates. Until a fix is released, restricting access to the admin interface and applying network-level protections to limit exposure may reduce risk. Review and harden server file permissions to minimize potential damage from path traversal attacks.