Description
A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-11-09
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Path Traversal
Action: Patch Now
AI Analysis

Impact

The vulnerability is a path traversal flaw triggered by manipulating the page slug argument in the save_page function of content.php. This flaw allows an attacker to access or modify arbitrary files on the server. Remote exploitation is explicitly possible, meaning the attacker only needs to send a crafted request to the vulnerable endpoint.

Affected Systems

PureBlog released by Kevquirk, versions up to and including 3.7.2, is affected. The vulnerability resides in the Page Editor component, specifically the includes/lib/content.php file. An upgrade to version 3.7.3 (or later) removes the flaw.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the web interface, and the flaw is exploitable from any client that can send an HTTP request to the vulnerable endpoint. The impact can extend to the entire web application if the attacker accesses or modifies arbitrary files.

Generated by OpenCVE AI on November 9, 2026 at 15:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PureBlog to version 3.7.3 or later to remove the vulnerability.
  • Limit the web server process permissions so it cannot write to sensitive directories and prevent creation of executable files.
  • Sanitize and validate the page slug input on the server side to reject any characters that could lead to directory traversal (e.g., ".." or slashes).

Generated by OpenCVE AI on November 9, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title kevquirk PureBlog Page Editor content.php save_page path traversal
First Time appeared Kevquirk
Kevquirk pureblog
Weaknesses CWE-22
CPEs cpe:2.3:a:kevquirk:pureblog:*:*:*:*:*:*:*:*
Vendors & Products Kevquirk
Kevquirk pureblog
References
Metrics cvssV2_0

{'score': 4.7, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Kevquirk Pureblog
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-09T14:15:20.001Z

Reserved: 2026-11-09T08:09:13.250Z

Link: CVE-2026-124636

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T15:17:18.817

Modified: 2026-11-09T15:17:18.967

Link: CVE-2026-124636

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T16:35:22Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')