Vulnerability record/PUBLISHED/Published Nov 14, 2026 15:45:17 UTC
CVE-2026-129260
A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
Base score5.1/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredHighPR
User interactionNoneUI
Vulnerable system confidentialityLowVC
Vulnerable system integrityLowVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityLowSC
Subsequent system integrityLowSI
Subsequent system availabilityLowSA
Exploit maturityProof of conceptE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:PCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedNov 14, 2026 15:45:17 UTC
PublishedNov 14, 2026 15:45:17 UTC
ReservedNov 13, 2026 20:03:13 UTC
Credits
- Geronimo (VulDB User)