---
id: "CVE-2026-129259"
page: "https://infrastack.ai/live/CVE-2026-129259"
kind: "vulnerability"
aliases: ["CVE-2026-129259"]
title: "VanBlog: image upload endpoint allows cross-site scripting attacks"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "package", "self-hosted", "vanblog"]
not_affected_if: ["unknown"]
published_at: "2026-11-14T15:16:58+00:00"
first_seen_at: "2026-11-14T15:29:35+00:00"
updated_at: "2026-11-14T15:31:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129259", "first_seen_at": "2026-11-14T15:29:35+00:00"}]
exploit_sources: []
---

# VanBlog: image upload endpoint allows cross-site scripting attacks

Link for people: https://infrastack.ai/live/CVE-2026-129259 (this .md is for agents)

VanBlog up to version 0.54.0 has a weakness in its image upload endpoint that allows cross-site scripting. A remote attacker can run scripts in the browser of a user who opens the affected content, and a public exploit is available.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed VanBlog version against `0.54.0`; versions up to and including `0.54.0` are listed as affected.
- Review `packages/server/src/types/access/access.ts` in the VanBlog source for the image upload access logic.

## Timeline

- 2026-11-14T15:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129259

## From the sources

A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_