Threats affecting pkg:github/crownztx/htmly

CVE-2026-37107 is a critical vulnerability in HTMLy version 3.1.1 that allows a remote attacker to escalate privileges via the get_feed function in the admin.php component. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

CVE-2026-18646 is a path traversal vulnerability in danpros HTMLy affecting versions 3.1.0 and 3.1.1. The flaw exists in the /system/htmly.php file within the Author Name Handler component, where manipulation of the Name argument can lead to unauthorized file path access. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-18645 is a path traversal vulnerability in danpros HTMLy versions 3.1.0 and 3.1.1. It affects the add_content function in the /system/admin/admin.php file, specifically the Admin Content Endpoint component. The vulnerability allows remote attackers to manipulate the oldfile argument to perform path traversal. The exploit code has been publicly released. The vendor has not responded to disclosure attempts and no official patch or remediation is currently available.

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.

Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The application fails to properly sanitize user input, allowing injection of arbitrary code

A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link Name parameter of Menu Editor module.