---
id: "CVE-2026-124636"
page: "https://infrastack.ai/live/CVE-2026-124636"
kind: "vulnerability"
aliases: ["CVE-2026-124636"]
title: "PureBlog: page editor path traversal lets remote users write files"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "pureblog", "self-hosted"]
not_affected_if: ["version-3.7.3-or-later"]
published_at: "2026-11-09T15:17:18+00:00"
first_seen_at: "2026-11-09T15:27:06+00:00"
updated_at: "2026-11-09T15:28:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124636", "first_seen_at": "2026-11-09T15:27:06+00:00"}]
exploit_sources: []
---

# PureBlog: page editor path traversal lets remote users write files

Link for people: https://infrastack.ai/live/CVE-2026-124636 (this .md is for agents)

PureBlog up to 3.7.2 does not sanitize the page slug in its Page Editor's save_page function, so a crafted slug escapes the intended folder. A remote attacker who can reach the editor can thereby read or write files outside the content directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PureBlog version in the project files or release tag; versions up to `3.7.2` are affected.
- Confirm whether the Page Editor is reachable from the internet and whether it requires login.

## Fix

- PureBlog: upgrade to `3.7.3`

## Timeline

- 2026-11-09T15:27:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124636

## Documents

- [fix] Patch: github.com https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3
- [fix] Release notes: github.com https://github.com/kevquirk/pureblog/releases/tag/v3.7.3

## From the sources

A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_