CVE-2026-88421: High severity APSL puput vulnerability
Published Sep 25, 2026
·Updated
Incorrect access control in the BlogPage.getentries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed.
Affected Software
1 affected component
APSL puput>=1.2.1<=2.2.0
Event History
Sep 25, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
APSL puput versions 1.2.1 through 2.2.0 are affected. Deployments that use restricted blog entries are exposed to disclosure through public-facing listing and feed functionality.
2
Does exploitation require authentication or special attacker access?
No. The issue can be exploited by unauthenticated attackers.
3
Where can restricted entries be exposed?
Restricted entries may be visible through the blog index; tag, category, author, and date archives; sidebar widgets; and the RSS feed.