PT-2026-6062 · Unknown · Bolo-Blog Bolo-Solo

Maoqiu · Publicado 2026-02-03 · Atualizado 2026-03-03 · CVE-2026-1810

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bolo-blog bolo-solo versions prior to 2.6.5

Description A path traversal issue exists in the ZIP File Handler component of bolo-blog bolo-solo. The issue is located in the unpackFilteredZip function within the src/main/java/org/b3log/solo/bolo/prop/BackupService.java file. Manipulating the File argument can lead to path traversal, and the attack can be carried out remotely. The exploit is publicly available. The project was notified of the issue but has not yet responded.

Recommendations Update bolo-blog bolo-solo to version 2.6.5 or later. As a temporary workaround, restrict access to the unpackFilteredZip function until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-1810

Produtos afetados

Bolo-Blog Bolo-Solo

Referências · 9

• 🔥 https://github.com/bolo-blog/bolo-solo/issues/326 · Exploit
• https://twitter.com/CVEnew/status/2018790668559368440 · Publicação no Twitter
• https://vuldb.com/?ctiid.343978 · Nota
• https://github.com/bolo-blog/bolo-solo · Nota
• https://t.me/cveNotify/153863 · Publicação no Telegram
• https://vuldb.com/?submit.742422 · Nota
• https://vuldb.com/?id.343978 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1810 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-1810 · Aviso do Fabricante