CVE-2026-129260: Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal
A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in test-20261013Patch d63aa163f10b6dc1080e2368fe8e71aa95b765cb
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability can be exploited remotely, but the supplied severity vector indicates high privileges are required. No user interaction is required.
Which deployments are affected?
Mereithhh VanBlog versions up to and including 0.54.0 are affected, specifically the Custom Page Handler's local.provider.ts use of fs.readFileSync.
Is exploit code available?
Yes. A public proof of concept has been disclosed, so organizations should treat exploitation as feasible.
What remediation is available?
Upgrade to version test-20261013 or later containing patch d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.