CVE-2026-1812 Details
Description
A vulnerability has been found in bolo-blog bolo-solo up to 2.6.4. This impacts the function importFromCnblogs of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component Filename Handler. The manipulation of the argument File leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
An arbitrary file write vulnerability has been identified in Bolo-Blog Bolo-Solo versions through 2.6.4. The issue arises in the 'importFromCnblogs' function within 'BackupService.java', where user-supplied filenames are not properly validated. This lack of security validation allows for directory traversal attacks, enabling attackers to write files to arbitrary locations on the server. Exploitation of this vulnerability could lead to overwriting or creating files that are accessible via the web, potentially including scripts that could be executed remotely.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bolo-blog/bolo-solo/ | [email protected] | Product |
| https://github.com/bolo-blog/bolo-solo/issues/328 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://vuldb.com/?ctiid.343980 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.343980 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.742582 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adlered bolo-solo | <= 2.6.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Feb 3, 2026 | New CVE Received | [email protected] |