{"id":"CVE-2026-129260","kind":"vulnerability","aliases":["CVE-2026-129260"],"related":[],"title":"VanBlog: path traversal in custom page handler reads arbitrary server files","description":"A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.","summary":"VanBlog up to 0.54.0 has a path traversal flaw in its custom page handler, where a user-supplied path is passed to fs.readFileSync without proper restriction. A remote attacker can use it to read files outside the intended directory on the server.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","other","self-hosted","vanblog"],"not_affected_if":["newer-version","not-vanblog"],"how_to_check":"- Check the installed VanBlog version; versions up to `0.54.0` are affected.\n- Look for `local.provider.ts` in your VanBlog code and confirm whether the custom page handler is reachable from outside.","fix":"- VanBlog: upgrade to `test-20261013` (per the sources, patch commit d63aa163f10b6dc1080e2368fe8e71aa95b765cb).","status":"open","published_at":"2026-11-14T16:17:04+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","triaged_at":"2026-11-14T16:31:29+00:00","updated_at":"2026-11-14T16:31:29+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T16:31:29Z","model":"claude-haiku-5-5","output":{"fix":"- VanBlog: upgrade to `test-20261013` (per the sources, patch commit d63aa163f10b6dc1080e2368fe8e71aa95b765cb).","reach":"internet","title":"VanBlog: path traversal in custom page handler reads arbitrary server files","impact":"medium","summary":"VanBlog up to 0.54.0 has a path traversal flaw in its custom page handler, where a user-supplied path is passed to fs.readFileSync without proper restriction. A remote attacker can use it to read files outside the intended directory on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vanblog","self-hosted","node"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reads arbitrary files from the server","analyst_note":"","how_to_check":"- Check the installed VanBlog version; versions up to `0.54.0` are affected.\n- Look for `local.provider.ts` in your VanBlog code and confirm whether the custom page handler is reachable from outside.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-vanblog","newer-version"],"who_is_affected":"Sites running VanBlog 0.54.0 or earlier are exposed when the custom page handler is reachable over the network. Teams running VanBlog only on a private network or behind access controls have less exposure. Anyone not running VanBlog can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000745,"input_tokens":4668,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129260':14A,17A '-2026':13A,16A '-20261013':128C '0.54.0':27B,78C 'abl':130C 'advis':147C 'affect':81C,144C 'arbitrari':9A 'argument':99C 'attack':53B,106C 'carri':111C 'compon':91C,145C 'custom':5A,35B,92C 'cve':12A,15A 'd63aa163f10b6dc1080e2368fe8e71aa95b765cb':141C 'detect':72C 'directori':63B 'disclos':118C 'exploit':115C 'file':11A,59B,87C 'flaw':32B 'fs.readfilesync':47B,84C 'function':83C 'handler':7A,37B,94C 'host':22B 'identifi':136C 'intend':62B 'issu':134C 'lead':101C 'local.provider.ts':88C 'manipul':96C 'may':121C 'mereithhh':74C 'node':18B 'outsid':60B 'page':6A,36B,93C 'pass':45B 'patch':139C 'path':2A,30B,43B,100C,103C 'possibl':108C 'proper':49B 'public':119C 'read':8A,58B 'remot':52B,113C 'resolv':132C 'restrict':50B 'secur':68C 'self':21B 'self-host':20B 'server':10A,66B 'suppli':42B 'test':127C 'travers':3A,31B,104C 'upgrad':124C,142C 'use':55B,123C 'user':41B 'user-suppli':40B 'vanblog':1A,23B,24B,75C 'version':126C 'vulner':69C,80C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Sites running VanBlog 0.54.0 or earlier are exposed when the custom page handler is reachable over the network. Teams running VanBlog only on a private network or behind access controls have less exposure. Anyone not running VanBlog can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","node","other","selfhosted","vanblog"],"campaign_type":null,"search_a":"'-129260':14A,17A '-2026':13A,16A 'arbitrari':9A 'custom':5A 'cve':12A,15A 'file':11A 'handler':7A 'page':6A 'path':2A 'read':8A 'server':10A 'travers':3A 'vanblog':1A","search_b":"'0.54.0':27B 'attack':53B 'custom':35B 'directori':63B 'file':59B 'flaw':32B 'fs.readfilesync':47B 'handler':37B 'host':22B 'intend':62B 'node':18B 'outsid':60B 'page':36B 'pass':45B 'path':30B,43B 'proper':49B 'read':58B 'remot':52B 'restrict':50B 'self':21B 'self-host':20B 'server':66B 'suppli':42B 'travers':31B 'use':55B 'user':41B 'user-suppli':40B 'vanblog':23B,24B 'without':48B","search_c":"'-20261013':128C '0.54.0':78C 'abl':130C 'advis':147C 'affect':81C,144C 'argument':99C 'attack':106C 'carri':111C 'compon':91C,145C 'custom':92C 'd63aa163f10b6dc1080e2368fe8e71aa95b765cb':141C 'detect':72C 'disclos':118C 'exploit':115C 'file':87C 'fs.readfilesync':84C 'function':83C 'handler':94C 'identifi':136C 'issu':134C 'lead':101C 'local.provider.ts':88C 'manipul':96C 'may':121C 'mereithhh':74C 'page':93C 'patch':139C 'path':100C,103C 'possibl':108C 'public':119C 'remot':113C 'resolv':132C 'secur':68C 'test':127C 'travers':104C 'upgrad':124C,142C 'use':123C 'vanblog':75C 'version':126C 'vulner':69C,80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T16:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129260","severity":null,"published_at":"2026-11-14T16:17:04+00:00","modified_at":"2026-11-14T16:17:04+00:00","first_seen_at":"2026-11-14T16:30:58+00:00","fetched_at":"2026-11-14T16:30:58+00:00","note":null}],"documents":[{"id":156901,"url":"https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":156902,"url":"https://github.com/Mereithhh/vanblog/releases/tag/test-20261013","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}