Search
Find a vulnerability
Search criteria
6 vulnerabilities found for VanBlog by Mereithhh
CVE-2026-129260 (GCVE-0-2026-129260)
Vulnerability from nvd – Published: 2026-11-14 15:45 – Updated: 2026-11-14 15:45 X_Open Source
VLAI
EPSS
VEX
Title
Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal
Summary
A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437298 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/437298/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129260 | third-party-advisory |
| https://vuldb.com/submit/1043274 | third-party-advisory |
| http://note.geronimo.xin/post/71 | exploit |
| https://github.com/Mereithhh/vanblog/pull/524 | issue-trackingpatch |
| https://github.com/Mereithhh/vanblog/commit/d63aa… | patch |
| https://github.com/Mereithhh/vanblog/releases/tag… | patch |
| https://github.com/Mereithhh/vanblog/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mereithhh | VanBlog |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16 Affected: 0.17 Affected: 0.18 Affected: 0.19 Affected: 0.20 Affected: 0.21 Affected: 0.22 Affected: 0.23 Affected: 0.24 Affected: 0.25 Affected: 0.26 Affected: 0.27 Affected: 0.28 Affected: 0.29 Affected: 0.30 Affected: 0.31 Affected: 0.32 Affected: 0.33 Affected: 0.34 Affected: 0.35 Affected: 0.36 Affected: 0.37 Affected: 0.38 Affected: 0.39 Affected: 0.40 Affected: 0.41 Affected: 0.42 Affected: 0.43 Affected: 0.44 Affected: 0.45 Affected: 0.46 Affected: 0.47 Affected: 0.48 Affected: 0.49 Affected: 0.50 Affected: 0.51 Affected: 0.52 Affected: 0.53 Affected: 0.54.0 Unaffected: test-20261013 cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Custom Page Handler"
],
"product": "VanBlog",
"vendor": "Mereithhh",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16"
},
{
"status": "affected",
"version": "0.17"
},
{
"status": "affected",
"version": "0.18"
},
{
"status": "affected",
"version": "0.19"
},
{
"status": "affected",
"version": "0.20"
},
{
"status": "affected",
"version": "0.21"
},
{
"status": "affected",
"version": "0.22"
},
{
"status": "affected",
"version": "0.23"
},
{
"status": "affected",
"version": "0.24"
},
{
"status": "affected",
"version": "0.25"
},
{
"status": "affected",
"version": "0.26"
},
{
"status": "affected",
"version": "0.27"
},
{
"status": "affected",
"version": "0.28"
},
{
"status": "affected",
"version": "0.29"
},
{
"status": "affected",
"version": "0.30"
},
{
"status": "affected",
"version": "0.31"
},
{
"status": "affected",
"version": "0.32"
},
{
"status": "affected",
"version": "0.33"
},
{
"status": "affected",
"version": "0.34"
},
{
"status": "affected",
"version": "0.35"
},
{
"status": "affected",
"version": "0.36"
},
{
"status": "affected",
"version": "0.37"
},
{
"status": "affected",
"version": "0.38"
},
{
"status": "affected",
"version": "0.39"
},
{
"status": "affected",
"version": "0.40"
},
{
"status": "affected",
"version": "0.41"
},
{
"status": "affected",
"version": "0.42"
},
{
"status": "affected",
"version": "0.43"
},
{
"status": "affected",
"version": "0.44"
},
{
"status": "affected",
"version": "0.45"
},
{
"status": "affected",
"version": "0.46"
},
{
"status": "affected",
"version": "0.47"
},
{
"status": "affected",
"version": "0.48"
},
{
"status": "affected",
"version": "0.49"
},
{
"status": "affected",
"version": "0.50"
},
{
"status": "affected",
"version": "0.51"
},
{
"status": "affected",
"version": "0.52"
},
{
"status": "affected",
"version": "0.53"
},
{
"status": "affected",
"version": "0.54.0"
},
{
"status": "unaffected",
"version": "test-20261013"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Geronimo (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T15:45:17.921Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437298 | Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/437298"
},
{
"name": "VDB-437298 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437298/cti"
},
{
"name": "CVE-2026-129260 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129260"
},
{
"name": "Submit #1043274 | Mereithhh VanBlog 0.54.0 Path Traversal to RCE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1043274"
},
{
"tags": [
"exploit"
],
"url": "http://note.geronimo.xin/post/71"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/pull/524"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/releases/tag/test-20261013"
},
{
"tags": [
"product"
],
"url": "https://github.com/Mereithhh/vanblog/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T21:08:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129260",
"datePublished": "2026-11-14T15:45:17.921Z",
"dateReserved": "2026-11-13T20:03:13.655Z",
"dateUpdated": "2026-11-14T15:45:17.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129259 (GCVE-0-2026-129259)
Vulnerability from nvd – Published: 2026-11-14 14:45 – Updated: 2026-11-14 14:45
VLAI
EPSS
VEX
Title
Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting
Summary
A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437297 | vdb-entry |
| https://vuldb.com/vuln/437297/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129259 | third-party-advisory |
| https://vuldb.com/submit/1043136 | third-party-advisory |
| http://note.geronimo.xin/post/70 | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mereithhh | VanBlog |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16 Affected: 0.17 Affected: 0.18 Affected: 0.19 Affected: 0.20 Affected: 0.21 Affected: 0.22 Affected: 0.23 Affected: 0.24 Affected: 0.25 Affected: 0.26 Affected: 0.27 Affected: 0.28 Affected: 0.29 Affected: 0.30 Affected: 0.31 Affected: 0.32 Affected: 0.33 Affected: 0.34 Affected: 0.35 Affected: 0.36 Affected: 0.37 Affected: 0.38 Affected: 0.39 Affected: 0.40 Affected: 0.41 Affected: 0.42 Affected: 0.43 Affected: 0.44 Affected: 0.45 Affected: 0.46 Affected: 0.47 Affected: 0.48 Affected: 0.49 Affected: 0.50 Affected: 0.51 Affected: 0.52 Affected: 0.53 Affected: 0.54.0 cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Image Upload Endpoint"
],
"product": "VanBlog",
"vendor": "Mereithhh",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16"
},
{
"status": "affected",
"version": "0.17"
},
{
"status": "affected",
"version": "0.18"
},
{
"status": "affected",
"version": "0.19"
},
{
"status": "affected",
"version": "0.20"
},
{
"status": "affected",
"version": "0.21"
},
{
"status": "affected",
"version": "0.22"
},
{
"status": "affected",
"version": "0.23"
},
{
"status": "affected",
"version": "0.24"
},
{
"status": "affected",
"version": "0.25"
},
{
"status": "affected",
"version": "0.26"
},
{
"status": "affected",
"version": "0.27"
},
{
"status": "affected",
"version": "0.28"
},
{
"status": "affected",
"version": "0.29"
},
{
"status": "affected",
"version": "0.30"
},
{
"status": "affected",
"version": "0.31"
},
{
"status": "affected",
"version": "0.32"
},
{
"status": "affected",
"version": "0.33"
},
{
"status": "affected",
"version": "0.34"
},
{
"status": "affected",
"version": "0.35"
},
{
"status": "affected",
"version": "0.36"
},
{
"status": "affected",
"version": "0.37"
},
{
"status": "affected",
"version": "0.38"
},
{
"status": "affected",
"version": "0.39"
},
{
"status": "affected",
"version": "0.40"
},
{
"status": "affected",
"version": "0.41"
},
{
"status": "affected",
"version": "0.42"
},
{
"status": "affected",
"version": "0.43"
},
{
"status": "affected",
"version": "0.44"
},
{
"status": "affected",
"version": "0.45"
},
{
"status": "affected",
"version": "0.46"
},
{
"status": "affected",
"version": "0.47"
},
{
"status": "affected",
"version": "0.48"
},
{
"status": "affected",
"version": "0.49"
},
{
"status": "affected",
"version": "0.50"
},
{
"status": "affected",
"version": "0.51"
},
{
"status": "affected",
"version": "0.52"
},
{
"status": "affected",
"version": "0.53"
},
{
"status": "affected",
"version": "0.54.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Geronimo (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T14:45:15.954Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437297 | Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/437297"
},
{
"name": "VDB-437297 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437297/cti"
},
{
"name": "CVE-2026-129259 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129259"
},
{
"name": "Submit #1043136 | Mereithhh VanBlog 0.54.0 Cross-Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1043136"
},
{
"tags": [
"exploit"
],
"url": "http://note.geronimo.xin/post/70"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T21:05:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129259",
"datePublished": "2026-11-14T14:45:15.954Z",
"dateReserved": "2026-11-13T20:00:03.414Z",
"dateUpdated": "2026-11-14T14:45:15.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125376 (GCVE-0-2026-125376)
Vulnerability from nvd – Published: 2026-11-09 23:27 – Updated: 2026-11-10 16:22
VLAI
EPSS
VEX
Title
VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
Summary
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:21 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Mereithhh/vanblog/issues/611 | issue-tracking |
| https://github.com/Mereithhh/vanblog | product |
| https://github.com/Mereithhh/vanblog/blob/8eb670b… | technical-description |
| https://github.com/Mereithhh/vanblog/commit/81b86… | patch |
| https://www.vulncheck.com/advisories/vanblog-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:21:57.085138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:22:08.636Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vanblog",
"vendor": "Mereithhh",
"versions": [
{
"lessThanOrEqual": "0.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:46.098Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #611",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Mereithhh/vanblog/issues/611"
},
{
"tags": [
"product"
],
"url": "https://github.com/Mereithhh/vanblog"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Mereithhh/vanblog/blob/8eb670b88e05572fd3c6039a89759abb6745dcab/packages/server/src/provider/article/article.provider.ts#L751-L780"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/commit/81b868f4d568c8accff62b9c35d0e556d1e7970d"
},
{
"name": "VulnCheck Advisory: VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vanblog-through-0.54.0-private-article-disclosure-via-public-password-endpoint"
}
],
"title": "VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125376",
"datePublished": "2026-11-09T23:27:46.098Z",
"dateReserved": "2026-11-09T22:03:06.141Z",
"dateUpdated": "2026-11-10T16:22:08.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129260 (GCVE-0-2026-129260)
Vulnerability from cvelistv5 – Published: 2026-11-14 15:45 – Updated: 2026-11-14 15:45 X_Open Source
VLAI
EPSS
VEX
Title
Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal
Summary
A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437298 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/437298/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129260 | third-party-advisory |
| https://vuldb.com/submit/1043274 | third-party-advisory |
| http://note.geronimo.xin/post/71 | exploit |
| https://github.com/Mereithhh/vanblog/pull/524 | issue-trackingpatch |
| https://github.com/Mereithhh/vanblog/commit/d63aa… | patch |
| https://github.com/Mereithhh/vanblog/releases/tag… | patch |
| https://github.com/Mereithhh/vanblog/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mereithhh | VanBlog |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16 Affected: 0.17 Affected: 0.18 Affected: 0.19 Affected: 0.20 Affected: 0.21 Affected: 0.22 Affected: 0.23 Affected: 0.24 Affected: 0.25 Affected: 0.26 Affected: 0.27 Affected: 0.28 Affected: 0.29 Affected: 0.30 Affected: 0.31 Affected: 0.32 Affected: 0.33 Affected: 0.34 Affected: 0.35 Affected: 0.36 Affected: 0.37 Affected: 0.38 Affected: 0.39 Affected: 0.40 Affected: 0.41 Affected: 0.42 Affected: 0.43 Affected: 0.44 Affected: 0.45 Affected: 0.46 Affected: 0.47 Affected: 0.48 Affected: 0.49 Affected: 0.50 Affected: 0.51 Affected: 0.52 Affected: 0.53 Affected: 0.54.0 Unaffected: test-20261013 cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Custom Page Handler"
],
"product": "VanBlog",
"vendor": "Mereithhh",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16"
},
{
"status": "affected",
"version": "0.17"
},
{
"status": "affected",
"version": "0.18"
},
{
"status": "affected",
"version": "0.19"
},
{
"status": "affected",
"version": "0.20"
},
{
"status": "affected",
"version": "0.21"
},
{
"status": "affected",
"version": "0.22"
},
{
"status": "affected",
"version": "0.23"
},
{
"status": "affected",
"version": "0.24"
},
{
"status": "affected",
"version": "0.25"
},
{
"status": "affected",
"version": "0.26"
},
{
"status": "affected",
"version": "0.27"
},
{
"status": "affected",
"version": "0.28"
},
{
"status": "affected",
"version": "0.29"
},
{
"status": "affected",
"version": "0.30"
},
{
"status": "affected",
"version": "0.31"
},
{
"status": "affected",
"version": "0.32"
},
{
"status": "affected",
"version": "0.33"
},
{
"status": "affected",
"version": "0.34"
},
{
"status": "affected",
"version": "0.35"
},
{
"status": "affected",
"version": "0.36"
},
{
"status": "affected",
"version": "0.37"
},
{
"status": "affected",
"version": "0.38"
},
{
"status": "affected",
"version": "0.39"
},
{
"status": "affected",
"version": "0.40"
},
{
"status": "affected",
"version": "0.41"
},
{
"status": "affected",
"version": "0.42"
},
{
"status": "affected",
"version": "0.43"
},
{
"status": "affected",
"version": "0.44"
},
{
"status": "affected",
"version": "0.45"
},
{
"status": "affected",
"version": "0.46"
},
{
"status": "affected",
"version": "0.47"
},
{
"status": "affected",
"version": "0.48"
},
{
"status": "affected",
"version": "0.49"
},
{
"status": "affected",
"version": "0.50"
},
{
"status": "affected",
"version": "0.51"
},
{
"status": "affected",
"version": "0.52"
},
{
"status": "affected",
"version": "0.53"
},
{
"status": "affected",
"version": "0.54.0"
},
{
"status": "unaffected",
"version": "test-20261013"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Geronimo (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T15:45:17.921Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437298 | Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/437298"
},
{
"name": "VDB-437298 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437298/cti"
},
{
"name": "CVE-2026-129260 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129260"
},
{
"name": "Submit #1043274 | Mereithhh VanBlog 0.54.0 Path Traversal to RCE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1043274"
},
{
"tags": [
"exploit"
],
"url": "http://note.geronimo.xin/post/71"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/pull/524"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/releases/tag/test-20261013"
},
{
"tags": [
"product"
],
"url": "https://github.com/Mereithhh/vanblog/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T21:08:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129260",
"datePublished": "2026-11-14T15:45:17.921Z",
"dateReserved": "2026-11-13T20:03:13.655Z",
"dateUpdated": "2026-11-14T15:45:17.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129259 (GCVE-0-2026-129259)
Vulnerability from cvelistv5 – Published: 2026-11-14 14:45 – Updated: 2026-11-14 14:45
VLAI
EPSS
VEX
Title
Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting
Summary
A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437297 | vdb-entry |
| https://vuldb.com/vuln/437297/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129259 | third-party-advisory |
| https://vuldb.com/submit/1043136 | third-party-advisory |
| http://note.geronimo.xin/post/70 | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mereithhh | VanBlog |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16 Affected: 0.17 Affected: 0.18 Affected: 0.19 Affected: 0.20 Affected: 0.21 Affected: 0.22 Affected: 0.23 Affected: 0.24 Affected: 0.25 Affected: 0.26 Affected: 0.27 Affected: 0.28 Affected: 0.29 Affected: 0.30 Affected: 0.31 Affected: 0.32 Affected: 0.33 Affected: 0.34 Affected: 0.35 Affected: 0.36 Affected: 0.37 Affected: 0.38 Affected: 0.39 Affected: 0.40 Affected: 0.41 Affected: 0.42 Affected: 0.43 Affected: 0.44 Affected: 0.45 Affected: 0.46 Affected: 0.47 Affected: 0.48 Affected: 0.49 Affected: 0.50 Affected: 0.51 Affected: 0.52 Affected: 0.53 Affected: 0.54.0 cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:*"
],
"modules": [
"Image Upload Endpoint"
],
"product": "VanBlog",
"vendor": "Mereithhh",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16"
},
{
"status": "affected",
"version": "0.17"
},
{
"status": "affected",
"version": "0.18"
},
{
"status": "affected",
"version": "0.19"
},
{
"status": "affected",
"version": "0.20"
},
{
"status": "affected",
"version": "0.21"
},
{
"status": "affected",
"version": "0.22"
},
{
"status": "affected",
"version": "0.23"
},
{
"status": "affected",
"version": "0.24"
},
{
"status": "affected",
"version": "0.25"
},
{
"status": "affected",
"version": "0.26"
},
{
"status": "affected",
"version": "0.27"
},
{
"status": "affected",
"version": "0.28"
},
{
"status": "affected",
"version": "0.29"
},
{
"status": "affected",
"version": "0.30"
},
{
"status": "affected",
"version": "0.31"
},
{
"status": "affected",
"version": "0.32"
},
{
"status": "affected",
"version": "0.33"
},
{
"status": "affected",
"version": "0.34"
},
{
"status": "affected",
"version": "0.35"
},
{
"status": "affected",
"version": "0.36"
},
{
"status": "affected",
"version": "0.37"
},
{
"status": "affected",
"version": "0.38"
},
{
"status": "affected",
"version": "0.39"
},
{
"status": "affected",
"version": "0.40"
},
{
"status": "affected",
"version": "0.41"
},
{
"status": "affected",
"version": "0.42"
},
{
"status": "affected",
"version": "0.43"
},
{
"status": "affected",
"version": "0.44"
},
{
"status": "affected",
"version": "0.45"
},
{
"status": "affected",
"version": "0.46"
},
{
"status": "affected",
"version": "0.47"
},
{
"status": "affected",
"version": "0.48"
},
{
"status": "affected",
"version": "0.49"
},
{
"status": "affected",
"version": "0.50"
},
{
"status": "affected",
"version": "0.51"
},
{
"status": "affected",
"version": "0.52"
},
{
"status": "affected",
"version": "0.53"
},
{
"status": "affected",
"version": "0.54.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Geronimo (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T14:45:15.954Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437297 | Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/437297"
},
{
"name": "VDB-437297 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437297/cti"
},
{
"name": "CVE-2026-129259 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129259"
},
{
"name": "Submit #1043136 | Mereithhh VanBlog 0.54.0 Cross-Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1043136"
},
{
"tags": [
"exploit"
],
"url": "http://note.geronimo.xin/post/70"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T21:05:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129259",
"datePublished": "2026-11-14T14:45:15.954Z",
"dateReserved": "2026-11-13T20:00:03.414Z",
"dateUpdated": "2026-11-14T14:45:15.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125376 (GCVE-0-2026-125376)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-10 16:22
VLAI
EPSS
VEX
Title
VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
Summary
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:21 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Mereithhh/vanblog/issues/611 | issue-tracking |
| https://github.com/Mereithhh/vanblog | product |
| https://github.com/Mereithhh/vanblog/blob/8eb670b… | technical-description |
| https://github.com/Mereithhh/vanblog/commit/81b86… | patch |
| https://www.vulncheck.com/advisories/vanblog-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:21:57.085138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:22:08.636Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vanblog",
"vendor": "Mereithhh",
"versions": [
{
"lessThanOrEqual": "0.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:46.098Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #611",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Mereithhh/vanblog/issues/611"
},
{
"tags": [
"product"
],
"url": "https://github.com/Mereithhh/vanblog"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Mereithhh/vanblog/blob/8eb670b88e05572fd3c6039a89759abb6745dcab/packages/server/src/provider/article/article.provider.ts#L751-L780"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Mereithhh/vanblog/commit/81b868f4d568c8accff62b9c35d0e556d1e7970d"
},
{
"name": "VulnCheck Advisory: VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vanblog-through-0.54.0-private-article-disclosure-via-public-password-endpoint"
}
],
"title": "VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125376",
"datePublished": "2026-11-09T23:27:46.098Z",
"dateReserved": "2026-11-09T22:03:06.141Z",
"dateUpdated": "2026-11-10T16:22:08.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}