CVE-2026-18646 is a path traversal vulnerability affecting danpros HTMLy up to version 3.1.1. The issue resides in the /system/htmly.php file's Author Name Handler component, where improper validation of the 'Name' argument enables remote attackers to perform directory traversal. This can potentially allow unauthorized access to files outside the intended directory. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9 (medium severity). Public exploit code is available, but no official patch or remediation has been provided by the vendor.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server by traversing directories, potentially exposing sensitive information. The vulnerability is remotely exploitable without any privileges or user interaction, increasing the risk. However, there is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as restricting access to the vulnerable component, applying web application firewall (WAF) rules to block path traversal patterns, or isolating the application environment until an official fix is released.