---
id: "CVE-2026-126659"
page: "https://infrastack.ai/live/CVE-2026-126659"
kind: "vulnerability"
aliases: ["CVE-2026-126659"]
title: "BlueprintUE Self-Hosted: anonymous blueprint uploads fill server disk"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["blueprintue", "other", "self-hosted"]
not_affected_if: ["managed-hosting", "version-4.3.5-or-later"]
published_at: "2026-11-11T13:17:24+00:00"
first_seen_at: "2026-11-11T13:27:16+00:00"
updated_at: "2026-11-11T13:29:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126659", "first_seen_at": "2026-11-11T13:27:16+00:00"}]
exploit_sources: []
---

# BlueprintUE Self-Hosted: anonymous blueprint uploads fill server disk

Link for people: https://infrastack.ai/live/CVE-2026-126659 (this .md is for agents)

BlueprintUE Self-Hosted Edition before 4.3.5 lets unauthenticated users create anonymous blueprints that never expire, and the purge routine does not clear them. An attacker can keep submitting large requests until the server's storage is full, denying service to everyone else.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BlueprintUE Self-Hosted version against `4.3.5`; anything below that in the `1.0.0` to `4.3.5` range is affected.
- Review the anonymous blueprint creation path (HomeController::doProcessCreateBlueprint) and whether requests with a 'never' expiration are accepted.

## Fix

- BlueprintUE Self-Hosted: move to `4.3.5` or later (fixed version per NVD description).

## Timeline

- 2026-11-11T13:27:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126659

## Documents

- [advisory] Vendor advisory: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints
- [fix] Patch: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de
- [fix] Release notes: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5

## From the sources

BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_