CVE-2026-129260

Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal

Published Nov 14, 2026 CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Description

A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.

Analysis

Technical impact

The vulnerability is a path traversal flaw in the fs.readFileSync function of the local.provider.ts component within the Custom Page Handler of Mereithhh VanBlog. This weakness (CWE‑22) allows an attacker to craft a file path that bypasses directory boundaries and read arbitrary files on the server. The exposed functionality can be invoked remotely, meaning a remote user can trigger the read operation without needing local access, potentially exposing sensitive configuration files or other secrets.

Affected Systems

Mereithhh VanBlog versions up to and including 0.54.0 are vulnerable. The patched release test‑20261013, which incorporates commit d63aa163f10b6dc1080e2368fe8e71aa95b765cb, addresses the flaw. Any installations running earlier releases or custom forks that have not applied this commit remain impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw can be exploited over the network by supplying a crafted path argument to the Custom Page Handler, leading to file disclosure. Because the affected function processes user input directly, successful exploitation requires only remote reach to the application and does not depend on elevated privileges on the host.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mereithhh

VanBlog

affected

Version	Status	Constraints
`0.1`	affected	—
`0.2`	affected	—
`0.3`	affected	—
`0.4`	affected	—
`0.5`	affected	—
`0.6`	affected	—
`0.7`	affected	—
`0.8`	affected	—
`0.9`	affected	—
`0.10`	affected	—
`0.11`	affected	—
`0.12`	affected	—
`0.13`	affected	—
`0.14`	affected	—
`0.15`	affected	—
`0.16`	affected	—
`0.17`	affected	—
`0.18`	affected	—
`0.19`	affected	—
`0.20`	affected	—
`0.21`	affected	—
`0.22`	affected	—
`0.23`	affected	—
`0.24`	affected	—
`0.25`	affected	—
`0.26`	affected	—
`0.27`	affected	—
`0.28`	affected	—
`0.29`	affected	—
`0.30`	affected	—
`0.31`	affected	—
`0.32`	affected	—
`0.33`	affected	—
`0.34`	affected	—
`0.35`	affected	—
`0.36`	affected	—
`0.37`	affected	—
`0.38`	affected	—
`0.39`	affected	—
`0.40`	affected	—
`0.41`	affected	—
`0.42`	affected	—
`0.43`	affected	—
`0.44`	affected	—
`0.45`	affected	—
`0.46`	affected	—
`0.47`	affected	—
`0.48`	affected	—
`0.49`	affected	—
`0.50`	affected	—
`0.51`	affected	—
`0.52`	affected	—
`0.53`	affected	—
`0.54.0`	affected	—
`test-20261013`	unaffected	—

No data.

Vendor Product Versions

Mereithhh

Vanblog

Version	Status	Scheme	Platform
`0.1`	affected	generic	—
`0.2`	affected	generic	—
`0.3`	affected	generic	—
`0.4`	affected	generic	—
`0.5`	affected	generic	—
`0.6`	affected	generic	—
`0.7`	affected	generic	—
`0.8`	affected	generic	—
`0.9`	affected	generic	—
`0.10`	affected	generic	—
`0.11`	affected	generic	—
`0.12`	affected	generic	—
`0.13`	affected	generic	—
`0.14`	affected	generic	—
`0.15`	affected	generic	—
`0.16`	affected	generic	—
`0.17`	affected	generic	—
`0.18`	affected	generic	—
`0.19`	affected	generic	—
`0.20`	affected	generic	—
`0.21`	affected	generic	—
`0.22`	affected	generic	—
`0.23`	affected	generic	—
`0.24`	affected	generic	—
`0.25`	affected	generic	—
`0.26`	affected	generic	—
`0.27`	affected	generic	—
`0.28`	affected	generic	—
`0.29`	affected	generic	—
`0.30`	affected	generic	—
`0.31`	affected	generic	—
`0.32`	affected	generic	—
`0.33`	affected	generic	—
`0.34`	affected	generic	—
`0.35`	affected	generic	—
`0.36`	affected	generic	—
`0.37`	affected	generic	—
`0.38`	affected	generic	—
`0.39`	affected	generic	—
`0.40`	affected	generic	—
`0.41`	affected	generic	—
`0.42`	affected	generic	—
`0.43`	affected	generic	—
`0.44`	affected	generic	—
`0.45`	affected	generic	—
`0.46`	affected	generic	—
`0.47`	affected	generic	—
`0.48`	affected	generic	—
`0.49`	affected	generic	—
`0.50`	affected	generic	—
`0.51`	affected	generic	—
`0.52`	affected	generic	—
`0.53`	affected	generic	—
`0.54.0`	affected	semver	—
`test-20261013`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the VanBlog installation to release test‑20261013 or newer, which includes the patch from commit d63aa163f10b6dc1080e2368fe8e71aa95b765cb.
Integrate the patched local.provider.ts file (or the commit referenced above) into your codebase to ensure that path arguments are properly validated and restricted.
If an immediate upgrade is not feasible, restrict or disable the Custom Page Handler endpoint to trusted users only, thereby limiting the attack surface until a fix can be applied.

Generated by OpenCVE AI on November 14, 2026 at 19:34 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://note.geronimo.xin/post/71
https://github.com/Mereithhh/vanblog/
https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb
https://github.com/Mereithhh/vanblog/pull/524
https://github.com/Mereithhh/vanblog/releases/tag/test-20261013
https://vuldb.com/cve/CVE-2026-129260
https://vuldb.com/submit/1043274
https://vuldb.com/vuln/437298
https://vuldb.com/vuln/437298/cti

History

Nov 14, 2026 4:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.
Title		Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal
First Time appeared		Mereithhh Mereithhh vanblog
Weaknesses		CWE-22
CPEs		cpe:2.3:a:mereithhh:vanblog::::::::
Vendors & Products		Mereithhh Mereithhh vanblog
References		http://note.geronimo.xin/post/71 https://github.com/Mereithhh/vanblog/ https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb https://github.com/Mereithhh/vanblog/pull/524 https://github.com/Mereithhh/vanblog/releases/tag/test-20261013 https://vuldb.com/cve/CVE-2026-129260 https://vuldb.com/submit/1043274 https://vuldb.com/vuln/437298 https://vuldb.com/vuln/437298/cti
Metrics		cvssV2_0 `{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.6, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}`

Subscriptions

Mereithhh Vanblog

Weaknesses

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

CVE record Updated: Nov 14, 2026, 3:45 PM

Status: PUBLISHED
Assigner: VulDB
Published: Nov 14, 2026, 3:45 PM
Updated: Nov 14, 2026, 3:45 PM
Reserved: Nov 13, 2026, 8:03 PM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Nov 14, 2026, 4:17 PM

Status: Deferred
Published: Nov 14, 2026, 4:17 PM
Modified: Nov 14, 2026, 4:17 PM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment Updated: Nov 14, 2026, 6:00 PM

Updated: Nov 14, 2026, 6:00 PM

JSON

Analysis

Technical impact

Affected Systems

Risk and Exploitability

Affected Products

Remediation

Tracking

Advisories

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Subscriptions

Sources

JSON object

JSON object

JSON object

JSON object

JSON object