PT-2026-6064 · Bolo Blog+1 · Bolo-Blog+1

Maoqiu · Publicado 2026-02-03 · Atualizado 2026-03-03 · CVE-2026-1812

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bolo-blog bolo-solo versions up to 2.6.4

Description A path traversal issue exists due to the manipulation of the File argument within the importFromCnblogs() function located in the src/main/java/org/b3log/solo/bolo/prop/BackupService.java file of the Filename Handler component. This allows for remote exploitation. The details of the exploit have been publicly disclosed. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to 2.6.4 should be used. As a temporary workaround, consider restricting access to the importFromCnblogs() function until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-1812

Produtos afetados

Bolo-Blog

Bolo-Solo

Referências · 10

• 🔥 https://github.com/bolo-blog/bolo-solo/issues/328 · Exploit
• https://github.com/bolo-blog/bolo-solo · Nota
• https://osv.dev/vulnerability/CVE-2026-1812 · Aviso do Fabricante
• https://t.me/cveNotify/153857 · Publicação no Telegram
• https://t.me/CVEtracker/43673 · Publicação no Telegram
• https://vuldb.com/?id.343980 · Nota
• https://vuldb.com/?ctiid.343980 · Nota
• https://twitter.com/CVEnew/status/2018913230941294668 · Publicação no Twitter
• https://vuldb.com/?submit.742582 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1812 · Nota de Segurança