Path Traversal Vulnerability in PureBlog

Executive Summary

This vulnerability is a path traversal flaw in PureBlog versions up to 3.7.2. It allows authenticated administrators to manipulate the page slug parameter to write arbitrary .md files outside the intended content/pages directory. The unsanitized slug enables directory traversal sequences like ../ to escape the pages directory, potentially overwriting or creating files in other directories where the PHP process has write permissions.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized .md files outside the content/pages directory. Inspect file paths in includes/lib/content.php for unsanitized slug handling. Look for unusual file writes in web server logs or directories with PHP write permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could tamper with content by overwriting existing files or creating new ones in unintended locations. This could lead to content manipulation or a local denial of service by overwriting critical files. However, it does not allow direct remote code execution due to the forced .md extension.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PureBlog to version 3.7.3 or apply the patch 71f5b0de2ecb2bb2934048ed40e1155c107484e3. Ensure administrator sessions are validated and CSRF tokens are enforced. Review file permissions to restrict write access outside designated directories.

Useful 0 Not Useful 0