CVE-2026-129260 · Other
NO FIX YET · SEE WHAT TO DO
VanBlog up to 0.54.0 has a path traversal flaw in its custom page handler, where a user-supplied path is passed to fs.readFileSync without proper restriction. A remote attacker can use it to read files outside the intended directory on the server.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running VanBlog 0.54.0 or earlier are exposed when the custom page handler is reachable over the network. Teams running VanBlog only on a private network or behind access controls have less exposure. Anyone not running VanBlog can skip it.
Not affected if newer-version, not-vanblog
Who cares node, self-hosted, vanblog
0.54.0 are affected.local.provider.ts in your VanBlog code and confirm whether the custom page handler is reachable from outside.test-20261013 (per the sources, patch commit d63aa163f10b6dc1080e2368fe8e71aa95b765cb).A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.