CVE-2026-45233 is a path traversal vulnerability affecting HTMLy CMS through version 3.1.1. Authenticated users with low privileges can exploit this by providing directory traversal sequences in the oldfile parameter at the admin autosave endpoint. The application fails to sanitize these inputs before passing them to file_exists() and rename() in admin.php, allowing attackers to relocate any file writable by the web server to an attacker-controlled draft location. This improper limitation of pathname to a restricted directory can lead to unauthorized file manipulation.

An attacker with low privileges can move arbitrary files writable by the web server to locations specified by the attacker, potentially leading to unauthorized file manipulation or disruption of application functionality. This could facilitate further attacks or data integrity issues. There is no indication of remote code execution or privilege escalation beyond file relocation in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions for the web server process to only necessary files and directories. Monitor for unusual file movements and consider limiting access to the admin autosave endpoint to trusted users only.