CVE-2026-124636 Details
Description
A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A path traversal vulnerability has been identified in kevquirk PureBlog versions through 3.7.2. The issue arises in the Page Editor component, specifically within the save_page function of includes/lib/content.php. The vulnerability allows authenticated administrators to manipulate the page slug argument, leading to unauthorized file writes outside the intended directory. While the exploitation is remote, the impact is limited to content tampering and potential denial-of-service, as the vulnerability does not allow direct code execution due to the enforced .md file extension.
Users are advised to upgrade to kevquirk PureBlog version 3.7.3, which addresses the vulnerability by sanitizing manually entered slugs to prevent path traversal.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kevquirk/pureblog/ | [email protected] | ProductVendor |
| https://github.com/kevquirk/pureblog/commit/71f5b0de2ecb2bb2934048ed40e1155c107484e3 | [email protected] | Source CodeVendor |
| https://github.com/kevquirk/pureblog/issues/87 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/kevquirk/pureblog/releases/tag/v3.7.3 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-124636 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1040559 | [email protected] | Permission Required |
| https://vuldb.com/vuln/433066 | [email protected] | Permission Required |
| https://vuldb.com/vuln/433066/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kevquirk PureBlog | <= 3.7.2 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |