CVE-2026-129260
Deferred Deferred - Pending Action

Path Traversal in VanBlog up to 0.54.0

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulDB

Description
A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129260
EUVD
EUVD-2026-125941

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mereithhh vanblog to 0.54.0 (inc)
mereithhh vanblog test-20261013

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129260 is a Path Traversal vulnerability in VanBlog versions up to 0.54.0. It allows attackers to read or write arbitrary files on the server by manipulating file paths in the Custom Page Handler component. The flaw exists due to insufficient path validation in functions like fs.readFileSync.

Detection Guidance

Check VanBlog versions below 0.54.0 or the test-20261013 release. Look for unauthorized file reads or writes in logs, especially for sensitive files like /etc/passwd or .env. Monitor for unexpected child processes spawned by the Waline settings restart or changes to main.js.

Impact Analysis

An authenticated administrator can exploit this to read sensitive files such as /etc/passwd, .env files, or database credentials. Attackers can also write malicious files to system directories, potentially gaining root-level access. Exploitation requires only HTTP access and an admin session.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Unauthorized file access may result in data breaches, triggering compliance violations and legal penalties.

Mitigation Strategies

Upgrade to test-20261013 or later. Ensure path validation is centralized and validate all uploaded files. Run the application as a non-root user. Verify the integrity of startup files like main.js. Restrict administrator access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129260. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...