{"id":"CVE-2026-129259","kind":"vulnerability","aliases":["CVE-2026-129259"],"related":[],"title":"VanBlog: image upload endpoint allows cross-site scripting attacks","description":"A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"VanBlog up to version 0.54.0 has a weakness in its image upload endpoint that allows cross-site scripting. A remote attacker can run scripts in the browser of a user who opens the affected content, and a public exploit is available.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","self-hosted","vanblog"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed VanBlog version against `0.54.0`; versions up to and including `0.54.0` are listed as affected.\n- Review `packages/server/src/types/access/access.ts` in the VanBlog source for the image upload access logic.","fix":null,"status":"open","published_at":"2026-11-14T15:16:58+00:00","first_seen_at":"2026-11-14T15:29:35+00:00","triaged_at":"2026-11-14T15:31:03+00:00","updated_at":"2026-11-14T15:31:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-14T15:31:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VanBlog: image upload endpoint allows cross-site scripting attacks","impact":"medium","summary":"VanBlog up to version 0.54.0 has a weakness in its image upload endpoint that allows cross-site scripting. A remote attacker can run scripts in the browser of a user who opens the affected content, and a public exploit is available.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vanblog","self-hosted","node.js"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs scripts in visitors' browsers via the site","analyst_note":"Confirm the fixed version and whether the upload endpoint requires login; check the NVD entry and the public exploit for the exact access-control gap.","how_to_check":"- Check the installed VanBlog version against `0.54.0`; versions up to and including `0.54.0` are listed as affected.\n- Review `packages/server/src/types/access/access.ts` in the VanBlog source for the image upload access logic.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"VanBlog deployments at version 0.54.0 or earlier that expose the image upload endpoint. The sources do not say which configuration is required, and do not name a fixed version. The vendor did not respond to the disclosure, so no patch is confirmed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4587,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129259':13A,16A '-2026':12A,15A '0.54.0':27B,75C 'affect':57B,77C 'allow':5A,37B 'attack':10A,44B,101C,120C 'avail':64B,111C 'browser':50B 'compon':87C 'contact':124C 'content':58B 'could':116C 'cross':7A,39B,97C 'cross-sit':6A,38B 'cve':11A,14A 'disclosur':128C 'earli':125C 'endpoint':4A,35B,90C 'execut':91C,104C 'exploit':62B,107C 'file':83C 'host':21B 'identifi':69C 'imag':2A,33B,88C 'lead':95C 'made':110C 'manipul':93C 'mereithhh':71C 'node.js':17B 'open':55B 'packag':18B 'packages/server/src/types/access/access.ts':84C 'part':80C 'public':61B,114C 'remot':43B,105C 'respond':132C 'run':46B 'script':9A,41B,47B,99C 'self':20B 'self-host':19B 'site':8A,40B,98C 'unknown':79C 'upload':3A,34B,89C 'use':118C 'user':53B 'vanblog':1A,22B,23B,72C 'vendor':122C 'version':26B 'way':135C 'weak':30B,66C","nicknames":[],"mitigations":[],"who_affected":"VanBlog deployments at version 0.54.0 or earlier that expose the image upload endpoint. The sources do not say which configuration is required, and do not name a fixed version. The vendor did not respond to the disclosure, so no patch is confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","nodejs","package","selfhosted","vanblog"],"campaign_type":null,"search_a":"'-129259':13A,16A '-2026':12A,15A 'allow':5A 'attack':10A 'cross':7A 'cross-sit':6A 'cve':11A,14A 'endpoint':4A 'imag':2A 'script':9A 'site':8A 'upload':3A 'vanblog':1A","search_b":"'0.54.0':27B 'affect':57B 'allow':37B 'attack':44B 'avail':64B 'browser':50B 'content':58B 'cross':39B 'cross-sit':38B 'endpoint':35B 'exploit':62B 'host':21B 'imag':33B 'node.js':17B 'open':55B 'packag':18B 'public':61B 'remot':43B 'run':46B 'script':41B,47B 'self':20B 'self-host':19B 'site':40B 'upload':34B 'user':53B 'vanblog':22B,23B 'version':26B 'weak':30B","search_c":"'0.54.0':75C 'affect':77C 'attack':101C,120C 'avail':111C 'compon':87C 'contact':124C 'could':116C 'cross':97C 'disclosur':128C 'earli':125C 'endpoint':90C 'execut':91C,104C 'exploit':107C 'file':83C 'identifi':69C 'imag':88C 'lead':95C 'made':110C 'manipul':93C 'mereithhh':71C 'packages/server/src/types/access/access.ts':84C 'part':80C 'public':114C 'remot':105C 'respond':132C 'script':99C 'site':98C 'unknown':79C 'upload':89C 'use':118C 'vanblog':72C 'vendor':122C 'way':135C 'weak':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T15:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129259","severity":null,"published_at":"2026-11-14T15:16:58+00:00","modified_at":"2026-11-14T15:16:58+00:00","first_seen_at":"2026-11-14T15:29:35+00:00","fetched_at":"2026-11-14T15:29:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}