{ "affected": [ { "ranges": [ { "database_specific": { "extracted_events": [ { "range": [ { "introduced": "0.1" }, { "last_affected": "0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.2" }, { "last_affected": "0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.4" }, { "last_affected": "0.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5" }, { "last_affected": "0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.6" }, { "last_affected": "0.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.7" }, { "last_affected": "0.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.8" }, { "last_affected": "0.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.9" }, { "last_affected": "0.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.10" }, { "last_affected": "0.10" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.11" }, { "last_affected": "0.11" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.12" }, { "last_affected": "0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.13" }, { "last_affected": "0.13" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.14" }, { "last_affected": "0.14" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.15" }, { "last_affected": "0.15" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.16" }, { "last_affected": "0.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.17" }, { "last_affected": "0.17" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.18" }, { "last_affected": "0.18" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.19" }, { "last_affected": "0.19" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.20" }, { "last_affected": "0.20" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.21" }, { "last_affected": "0.21" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.22" }, { "last_affected": "0.22" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.23" }, { "last_affected": "0.23" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.24" }, { "last_affected": "0.24" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.25" }, { "last_affected": "0.25" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.26" }, { "last_affected": "0.26" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.27" }, { "last_affected": "0.27" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.28" }, { "last_affected": "0.28" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.29" }, { "last_affected": "0.29" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.30" }, { "last_affected": "0.30" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.31" }, { "last_affected": "0.31" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.32" }, { "last_affected": "0.32" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.33" }, { "last_affected": "0.33" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.34" }, { "last_affected": "0.34" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.35" }, { "last_affected": "0.35" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.36" }, { "last_affected": "0.36" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.37" }, { "last_affected": "0.37" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.38" }, { "last_affected": "0.38" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.39" }, { "last_affected": "0.39" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.40" }, { "last_affected": "0.40" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.41" }, { "last_affected": "0.41" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.42" }, { "last_affected": "0.42" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.43" }, { "last_affected": "0.43" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.44" }, { "last_affected": "0.44" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.45" }, { "last_affected": "0.45" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.46" }, { "last_affected": "0.46" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.47" }, { "last_affected": "0.47" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.48" }, { "last_affected": "0.48" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.49" }, { "last_affected": "0.49" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.50" }, { "last_affected": "0.50" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.51" }, { "last_affected": "0.51" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.52" }, { "last_affected": "0.52" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.53" }, { "last_affected": "0.53" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.54.0" }, { "last_affected": "0.54.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "d63aa163f10b6dc1080e2368fe8e71aa95b765cb" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "test-20261013", "range": [ { "fixed": "3143bac910a7ce436b4caaa9b89d6c8d3d89364d" } ], "source": "REFERENCES_TAG" } ] }, "events": [ { "introduced": "dec4bb8180f868aba3f0df76dcca7d0aa6202c35" }, { "last_affected": "8eb670b88e05572fd3c6039a89759abb6745dcab" }, { "fixed": "d63aa163f10b6dc1080e2368fe8e71aa95b765cb" }, { "fixed": "3143bac910a7ce436b4caaa9b89d6c8d3d89364d" } ], "repo": "https://github.com/mereithhh/vanblog", "type": "GIT" } ], "versions": [ "0.1", "0.10", "0.11", "0.12", "0.13", "0.14", "0.15", "0.16", "0.17", "0.18", "0.19", "0.2", "0.20", "0.21", "0.22", "0.23", "0.24", "0.25", "0.26", "0.27", "0.28", "0.29", "0.30", "0.31", "0.32", "0.33", "0.34", "0.35", "0.36", "0.37", "0.38", "0.39", "0.4", "0.40", "0.41", "0.42", "0.43", "0.44", "0.45", "0.46", "0.47", "0.48", "0.49", "0.5", "0.50", "0.51", "0.52", "0.53", "0.54.0", "0.6", "0.7", "0.8", "0.9" ] } ], "database_specific": { "cna_assigner": "VulDB", "cwe_ids": [ "CWE-22" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129260.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "0.3" }, { "last_affected": "0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" } ] } ] }, "details": "A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.", "id": "CVE-2026-129260", "modified": "2026-11-15T02:30:44.886712397Z", "published": "2026-11-14T15:45:17.921Z", "references": [ { "type": "EVIDENCE", "url": "http://note.geronimo.xin/post/71" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129260.json" }, { "type": "ARTICLE", "url": "https://github.com/Mereithhh/vanblog/" }, { "type": "FIX", "url": "https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb" }, { "type": "FIX", "url": "https://github.com/Mereithhh/vanblog/pull/524" }, { "type": "FIX", "url": "https://github.com/Mereithhh/vanblog/releases/tag/test-20261013" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129260" }, { "type": "ADVISORY", "url": "https://vuldb.com/cve/CVE-2026-129260" }, { "type": "ADVISORY", "url": "https://vuldb.com/submit/1043274" }, { "type": "ADVISORY", "url": "https://vuldb.com/vuln/437298" }, { "type": "REPORT", "url": "https://vuldb.com/vuln/437298/cti" } ], "schema_version": "1.9.2", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P", "type": "CVSS_V4" } ], "summary": "Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal" }