CVE-2026-18645 danpros CVE debrief

Who should care

Defenders of systems using danpros HTMLy up to 3.1.1 should assess exposure and prioritize patching or mitigation. This includes administrators, security teams, and operators responsible for maintaining HTMLy installations. They should verify the exposure of their installations, apply patches or mitigations as necessary, and monitor for potential exploitation attempts. Additionally, defenders should review compensating controls for exposed systems and keep

Why it matters

A path traversal vulnerability in danpros HTMLy up to 3.1.1 allows remote attackers to manipulate files. Defenders should verify exposure, apply patches or mitigations, and monitor for exploitation attempts.

• Verify exposure of HTMLy installations
• Apply patches or mitigations to prevent exploitation
• Monitor for potential exploitation attempts

Technical summary

The add_content function in /system/admin/admin.php of danpros HTMLy up to 3.1.1 is vulnerable to path traversal. The attack can be initiated remotely by manipulating the oldfile argument. This vulnerability allows attackers to traverse the file system, potentially leading to unauthorized access or modification of sensitive files. Defenders should prioritize verifying exposure of HTMLy installations and applying patches or mitigations to prevent exploitation. The vulnerability has been confirmed in danpros HTMLy up to version 3.1.1, and defenders should assess the exposure of their installations.

Defensive priority

Defenders should prioritize verifying exposure of HTMLy installations and applying patches or mitigations.

Recommended defensive actions

• Verify exposure of HTMLy installations
• Apply patches or mitigations
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the vendor did not respond to early disclosure, and the exploit has been released publicly. The vulnerability has been confirmed in danpros HTMLy up to version 3.1.1. There is no indication of a vendor-provided patch or workaround at this time. Defenders should verify the exposure of HTMLy installations and apply patches or mitigations as necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.