This vulnerability in danpros HTMLy up to version 3.1.1 allows remote attackers to perform path traversal attacks by manipulating the Name parameter in the /system/htmly.php file's Author Name Handler component. This can potentially allow attackers to access files outside the intended directory. The vendor was notified but has not issued any response or patch. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation could allow an attacker to read arbitrary files on the server by traversing directories, potentially exposing sensitive information. There is no indication of privilege escalation or remote code execution from the provided data. The vulnerability is remotely exploitable without authentication.

No official fix or patch is currently available, and the vendor has not responded to disclosure. Users should monitor vendor communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block path traversal attempts targeting the Name parameter. Restricting file system permissions to limit access may also reduce impact.