CVE-2026-45233

HighCVSS 8.1/10Last modified Jul 14, 2026

Description

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jul 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-45246.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.1 CVE-2026-452427.1Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to CVE-2026-452436.1Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicio CVE-2026-452445.4Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without CVE-2026-452457.4Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover CVE-2026-452465.5Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows loca CVE-2026-452479.8Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticat CVE-2026-452485.3Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows CVE-2026-452496.1A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apac CVE-2026-45258.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va CVE-2026-452507.8The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-su CVE-2026-452517.8A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked t