PT-2026-52489 · Htmly Cms · Htmly Cms

Midhun Mohanan · Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-45233

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTMLy CMS versions prior to 3.1.2

Description Low-privileged authenticated attackers can relocate arbitrary files by providing directory traversal sequences in the oldfile parameter at the 'admin autosave' endpoint. The application passes unsanitized sequences to the file exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement. This allows the relocation of any file writable by the web server process to a draft location specified by the attacker.

Recommendations Update to version 3.1.2 or later. As a temporary mitigation, restrict access to the 'admin autosave' endpoint for low-privileged users.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-45233

Affected Products

Htmly Cms

References · 4

• 🔥 https://gist.github.com/mrgr4yhat/c4df971eafa272ac8c86c15e2829b7fe · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45233 · Security Note
• https://vulncheck.com/advisories/htmly-cms-path-traversal-via-oldfile-parameter-in-autosave · Note
• https://twitter.com/mrgr4yhat/status/2070178952283607473 · Twitter Post