CVE-2026-129260 - Vulnerability Details

- Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal

Description

A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.

Published: 2026-11-14

Score: 5.1 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mereithhh

VanBlog

affected

Version	Status	Constraints
`0.1`	affected	—
`0.2`	affected	—
`0.3`	affected	—
`0.4`	affected	—
`0.5`	affected	—
`0.6`	affected	—
`0.7`	affected	—
`0.8`	affected	—
`0.9`	affected	—
`0.10`	affected	—
`0.11`	affected	—
`0.12`	affected	—
`0.13`	affected	—
`0.14`	affected	—
`0.15`	affected	—
`0.16`	affected	—
`0.17`	affected	—
`0.18`	affected	—
`0.19`	affected	—
`0.20`	affected	—
`0.21`	affected	—
`0.22`	affected	—
`0.23`	affected	—
`0.24`	affected	—
`0.25`	affected	—
`0.26`	affected	—
`0.27`	affected	—
`0.28`	affected	—
`0.29`	affected	—
`0.30`	affected	—
`0.31`	affected	—
`0.32`	affected	—
`0.33`	affected	—
`0.34`	affected	—
`0.35`	affected	—
`0.36`	affected	—
`0.37`	affected	—
`0.38`	affected	—
`0.39`	affected	—
`0.40`	affected	—
`0.41`	affected	—
`0.42`	affected	—
`0.43`	affected	—
`0.44`	affected	—
`0.45`	affected	—
`0.46`	affected	—
`0.47`	affected	—
`0.48`	affected	—
`0.49`	affected	—
`0.50`	affected	—
`0.51`	affected	—
`0.52`	affected	—
`0.53`	affected	—
`0.54.0`	affected	—
`test-20261013`	unaffected	—

No data.

Vendor Product Confidence Versions

Mereithhh

Vanblog

95%

Version	Status	Scheme	Platform
`0.1`	affected	generic	—
`0.2`	affected	generic	—
`0.3`	affected	generic	—
`0.4`	affected	generic	—
`0.5`	affected	generic	—
`0.6`	affected	generic	—
`0.7`	affected	generic	—
`0.8`	affected	generic	—
`0.9`	affected	generic	—
`0.10`	affected	generic	—
`0.11`	affected	generic	—
`0.12`	affected	generic	—
`0.13`	affected	generic	—
`0.14`	affected	generic	—
`0.15`	affected	generic	—
`0.16`	affected	generic	—
`0.17`	affected	generic	—
`0.18`	affected	generic	—
`0.19`	affected	generic	—
`0.20`	affected	generic	—
`0.21`	affected	generic	—
`0.22`	affected	generic	—
`0.23`	affected	generic	—
`0.24`	affected	generic	—
`0.25`	affected	generic	—
`0.26`	affected	generic	—
`0.27`	affected	generic	—
`0.28`	affected	generic	—
`0.29`	affected	generic	—
`0.30`	affected	generic	—
`0.31`	affected	generic	—
`0.32`	affected	generic	—
`0.33`	affected	generic	—
`0.34`	affected	generic	—
`0.35`	affected	generic	—
`0.36`	affected	generic	—
`0.37`	affected	generic	—
`0.38`	affected	generic	—
`0.39`	affected	generic	—
`0.40`	affected	generic	—
`0.41`	affected	generic	—
`0.42`	affected	generic	—
`0.43`	affected	generic	—
`0.44`	affected	generic	—
`0.45`	affected	generic	—
`0.46`	affected	generic	—
`0.47`	affected	generic	—
`0.48`	affected	generic	—
`0.49`	affected	generic	—
`0.50`	affected	generic	—
`0.51`	affected	generic	—
`0.52`	affected	generic	—
`0.53`	affected	generic	—
`0.54.0`	affected	semver	—
`test-20261013`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://note.geronimo.xin/post/71
https://github.com/Mereithhh/vanblog/
https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb
https://github.com/Mereithhh/vanblog/pull/524
https://github.com/Mereithhh/vanblog/releases/tag/test-20261013
https://vuldb.com/cve/CVE-2026-129260
https://vuldb.com/submit/1043274
https://vuldb.com/vuln/437298
https://vuldb.com/vuln/437298/cti

History

Sat, 14 Nov 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
Title		Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal
First Time appeared		Mereithhh Mereithhh vanblog
Weaknesses		CWE-22
CPEs		cpe:2.3:a:mereithhh:vanblog::::::::
Vendors & Products		Mereithhh Mereithhh vanblog
References		http://note.geronimo.xin/post/71 https://github.com/Mereithhh/vanblog/ https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb https://github.com/Mereithhh/vanblog/pull/524 https://github.com/Mereithhh/vanblog/releases/tag/test-20261013 https://vuldb.com/cve/CVE-2026-129260 https://vuldb.com/submit/1043274 https://vuldb.com/vuln/437298 https://vuldb.com/vuln/437298/cti
Metrics		cvssV2_0 `{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}`

Subscriptions

Mereithhh Vanblog

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-11-14T15:45:17.921Z

Updated: 2026-11-14T15:45:17.921Z

Reserved: 2026-11-13T20:03:13.655Z

Link: CVE-2026-129260

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-11-14T16:17:04.297

Modified: 2026-11-14T16:17:04.450

Link: CVE-2026-129260

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-14T20:30:07Z

Weaknesses

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object