CVE-2026-124635 Details
Description
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability in kevquirk PureBlog versions through 3.7.2 allows authenticated administrators to upload files with dangerous extensions via the admin image upload endpoint. The endpoint only validates the uploaded file's MIME type, not the file extension, creating an opportunity for exploitation. In environments without the Imagick PHP extension, uploaded GIF or AVIF files are not re-encoded, allowing a GIF polyglot named shell.php to be executed as PHP, resulting in remote code execution.
Users are advised to upgrade to kevquirk PureBlog version 3.7.3, which restricts image upload extensions to match the verified MIME type and removes interior dots from filenames to prevent double-extension bypasses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kevquirk/pureblog/ | [email protected] | ProductVendor |
| https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3 | [email protected] | Source CodeVendor |
| https://github.com/kevquirk/pureblog/issues/86 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/kevquirk/pureblog/releases/tag/v3.7.3 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-124635 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1040557 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/433065 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/433065/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kevquirk PureBlog | <= 3.7.2 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |