Threats affecting pkg:github/danpros/htmly

CVE-2026-37107 is a critical vulnerability in HTMLy version 3.1.1 that allows a remote attacker to escalate privileges via the get_feed function in the admin.php component. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

CVE-2026-18646 is a path traversal vulnerability in danpros HTMLy affecting versions 3.1.0 and 3.1.1. The flaw exists in the /system/htmly.php file within the Author Name Handler component, where manipulation of the Name argument can lead to unauthorized file path access. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-18645 is a path traversal vulnerability in danpros HTMLy versions 3.1.0 and 3.1.1. It affects the add_content function in the /system/admin/admin.php file, specifically the Admin Content Endpoint component. The vulnerability allows remote attackers to manipulate the oldfile argument to perform path traversal. The exploit code has been publicly released. The vendor has not responded to disclosure attempts and no official patch or remediation is currently available.

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The application fails to properly sanitize user input, allowing injection of arbitrary code