CVE-2026-124635
Deferred Deferred - Pending Action

Unrestricted File Upload in PureBlog Admin Panel

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulDB

Description
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124635
EUVD
EUVD-2026-120062

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kevquirk pureblog to 3.7.2 (inc)
kevquirk pureblog 3.7.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124635 is an unrestricted file upload vulnerability in PureBlog versions up to 3.7.2. It allows authenticated administrators to upload malicious PHP files disguised as images by exploiting improper filename and MIME type validation in the admin/upload-image.php endpoint. The vulnerability occurs because the system checks MIME types but does not enforce safe file extensions, enabling attackers to upload GIF polyglot files with .php extensions. If the PHP environment runs in GD-only mode and .htaccess restrictions are not enforced, the attacker can execute the uploaded PHP payload via a crafted URL.

Detection Guidance

Check for unauthorized PHP files in the content/images/ directory. Look for files with double extensions or mismatched MIME types. Verify if .htaccess restrictions are enforced in the images directory. Use commands like 'find /path/to/pureblog/content/images/ -name "*.php"' to detect suspicious files.

Impact Analysis

This vulnerability allows remote attackers with administrator access to upload and execute arbitrary PHP code on the server. This could lead to full system compromise, unauthorized data access, defacement of the website, or further lateral movement within the network. The impact depends on the server's configuration and whether .htaccess restrictions are enforced.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected PureBlog versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized modifications.

Mitigation Strategies

Upgrade PureBlog to version 3.7.3 or later. Ensure image uploads are restricted to verified MIME types and safe extensions. Enforce .htaccess restrictions in the content/images/ directory. Remove any unauthorized PHP files from the images directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...