---
id: "CVE-2026-129260"
page: "https://infrastack.ai/live/CVE-2026-129260"
kind: "vulnerability"
aliases: ["CVE-2026-129260"]
title: "VanBlog: path traversal in custom page handler reads arbitrary server files"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["node", "other", "self-hosted", "vanblog"]
not_affected_if: ["newer-version", "not-vanblog"]
published_at: "2026-11-14T16:17:04+00:00"
first_seen_at: "2026-11-14T16:30:58+00:00"
updated_at: "2026-11-14T16:31:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129260", "first_seen_at": "2026-11-14T16:30:58+00:00"}]
exploit_sources: []
---

# VanBlog: path traversal in custom page handler reads arbitrary server files

Link for people: https://infrastack.ai/live/CVE-2026-129260 (this .md is for agents)

VanBlog up to 0.54.0 has a path traversal flaw in its custom page handler, where a user-supplied path is passed to fs.readFileSync without proper restriction. A remote attacker can use it to read files outside the intended directory on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed VanBlog version; versions up to `0.54.0` are affected.
- Look for `local.provider.ts` in your VanBlog code and confirm whether the custom page handler is reachable from outside.

## Fix

- VanBlog: upgrade to `test-20261013` (per the sources, patch commit d63aa163f10b6dc1080e2368fe8e71aa95b765cb).

## Timeline

- 2026-11-14T16:30:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129260

## Documents

- [fix] Patch: github.com https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb
- [fix] Release notes: github.com https://github.com/Mereithhh/vanblog/releases/tag/test-20261013

## From the sources

A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_