A flaw was discovered in the importMarkdownsSync function of the BackupService component of bolo‑solo, which uses SnakeYAML to deserialize data supplied to the function. The deserialization process accepts untrusted input and can produce arbitrary objects, enabling remote attackers to influence the program’s execution flow and potentially execute malicious code in the context of the deployed application. The vulnerability is not a denial‑of‑service issue; instead, it provides a path for an attacker to run code on the host that runs the vulnerable application. The weakness is a classic deserialization of untrusted data coupled with improper input validation.

All installations of the bolo‑solo application up to and including version 2.6.4 are vulnerable. The issue appears in the source file src/main/java/org/b3log/solo/bolo/prop/BackupService.java and is triggered by the importMarkdownsSync operation. Users with recent releases beyond 2.6.4 are presumed to be unaffected, though the exact patch version is not specified in the advisory.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is reported as less than 1%, implying a very low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a remote entry point that calls importMarkdownsSync, so protecting or disabling that endpoint reduces the attack surface. While the flaw can lead to remote code execution, the low exploitation probability suggests immediate patching is advised but not urgent if remediation cannot be applied without risk to service availability.