{"id":"CVE-2026-129260","summary":"Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal","details":"A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.","modified":"2026-11-15T02:46:40.680097024Z","published":"2026-11-14T15:45:17.921Z","database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129260.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"0.3"},{"last_affected":"0.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}],"cna_assigner":"VulDB"},"references":[{"type":"EVIDENCE","url":"http://note.geronimo.xin/post/71"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129260.json"},{"type":"ARTICLE","url":"https://github.com/Mereithhh/vanblog/"},{"type":"FIX","url":"https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb"},{"type":"FIX","url":"https://github.com/Mereithhh/vanblog/pull/524"},{"type":"FIX","url":"https://github.com/Mereithhh/vanblog/releases/tag/test-20261013"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129260"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-129260"},{"type":"ADVISORY","url":"https://vuldb.com/submit/1043274"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/437298"},{"type":"REPORT","url":"https://vuldb.com/vuln/437298/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mereithhh/vanblog","events":[{"introduced":"dec4bb8180f868aba3f0df76dcca7d0aa6202c35"},{"last_affected":"8eb670b88e05572fd3c6039a89759abb6745dcab"},{"fixed":"d63aa163f10b6dc1080e2368fe8e71aa95b765cb"},{"fixed":"3143bac910a7ce436b4caaa9b89d6c8d3d89364d"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.1"},{"last_affected":"0.1"}]},{"range":[{"introduced":"0.2"},{"last_affected":"0.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.4"},{"last_affected":"0.4"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5"},{"last_affected":"0.5"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.6"},{"last_affected":"0.6"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.7"},{"last_affected":"0.7"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.8"},{"last_affected":"0.8"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.9"},{"last_affected":"0.9"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.10"},{"last_affected":"0.10"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.11"},{"last_affected":"0.11"}]},{"range":[{"introduced":"0.12"},{"last_affected":"0.12"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.13"},{"last_affected":"0.13"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.14"},{"last_affected":"0.14"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.15"},{"last_affected":"0.15"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.16"},{"last_affected":"0.16"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.17"},{"last_affected":"0.17"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.18"},{"last_affected":"0.18"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.19"},{"last_affected":"0.19"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.20"},{"last_affected":"0.20"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.21"},{"last_affected":"0.21"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.22"},{"last_affected":"0.22"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.23"},{"last_affected":"0.23"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.24"},{"last_affected":"0.24"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.25"},{"last_affected":"0.25"}]},{"range":[{"introduced":"0.26"},{"last_affected":"0.26"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.27"},{"last_affected":"0.27"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.28"},{"last_affected":"0.28"}]},{"range":[{"introduced":"0.29"},{"last_affected":"0.29"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.30"},{"last_affected":"0.30"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.31"},{"last_affected":"0.31"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.32"},{"last_affected":"0.32"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.33"},{"last_affected":"0.33"}]},{"range":[{"introduced":"0.34"},{"last_affected":"0.34"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.35"},{"last_affected":"0.35"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.36"},{"last_affected":"0.36"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.37"},{"last_affected":"0.37"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.38"},{"last_affected":"0.38"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.39"},{"last_affected":"0.39"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.40"},{"last_affected":"0.40"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.41"},{"last_affected":"0.41"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.42"},{"last_affected":"0.42"}]},{"range":[{"introduced":"0.43"},{"last_affected":"0.43"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.44"},{"last_affected":"0.44"}]},{"range":[{"introduced":"0.45"},{"last_affected":"0.45"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.46"},{"last_affected":"0.46"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.47"},{"last_affected":"0.47"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.48"},{"last_affected":"0.48"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.49"},{"last_affected":"0.49"}]},{"range":[{"introduced":"0.50"},{"last_affected":"0.50"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.51"},{"last_affected":"0.51"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.52"},{"last_affected":"0.52"}]},{"range":[{"introduced":"0.53"},{"last_affected":"0.53"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.54.0"},{"last_affected":"0.54.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d63aa163f10b6dc1080e2368fe8e71aa95b765cb"}]},{"source":"REFERENCES_TAG","original_tag":"test-20261013","range":[{"fixed":"3143bac910a7ce436b4caaa9b89d6c8d3d89364d"}]}]}}],"versions":["0.1","0.10","0.11","0.12","0.13","0.14","0.15","0.16","0.17","0.18","0.19","0.2","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.27","0.28","0.29","0.30","0.31","0.32","0.33","0.34","0.35","0.36","0.37","0.38","0.39","0.4","0.40","0.41","0.42","0.43","0.44","0.45","0.46","0.47","0.48","0.49","0.5","0.50","0.51","0.52","0.53","0.54.0","0.6","0.7","0.8","0.9","v0.54.0","doc-0.12.168","doc-0.12.167","doc-0.12.166","v0.53.0","v0.52.0","test-202304215","doc-0.12.165","doc-0.12.164","doc-0.12.163","doc-0.12.162","doc-0.12.161","doc-0.12.160","v0.51.1","doc-0.12.159","doc-0.12.158","v0.51.0","doc-0.12.157","doc-0.12.156","v0.50.0","doc-0.12.155","v0.49.0","doc-0.12.154","v0.48.4","doc-0.12.153","doc-0.12.152","v0.48.3","doc-0.12.151","doc-0.12.150","doc-0.12.149","doc-0.12.143","v0.48.1","doc-0.12.142","doc-0.12.141","v0.48.0","doc-0.12.132","v0.45.6","doc-0.12.131","doc-0.12.130","doc-0.12.129","v0.45.5","doc-0.12.128","v0.45.4","doc-0.12.127","v0.45.3","doc-0.12.126","v0.45.2","doc-0.12.125","v0.45.1","doc-0.12.124","v0.45.0","doc-0.12.123","0.12.124","v0.44.0","doc-0.12.121","doc-0.12.120","doc-0.12.119","doc-0.12.118","doc-0.12.117","v0.43.1","v0.43.0","doc-0.12.116","doc-0.12.115","doc-0.12.114","doc-0.12.113","doc-0.12.112","doc-0.12.111","v0.42.0","doc-0.12.110","v0.41.5","v0.41.4","doc-0.12.109","doc-0.12.108","v0.41.3","doc-0.12.107","v0.41.2","doc-0.12.106","doc-0.12.105","doc-0.12.104","v0.41.1","doc-0.12.103","doc-0.12.102","doc-0.12.101","doc-0.12.100","doc-0.12.99","v0.41.0","doc-0.12.98","test-0923","doc-0.12.97","doc-0.12.96","doc-0.12.95","doc-0.12.94","v0.40.2","doc-0.12.93","doc-0.12.92","doc-0.12.91","v0.40.1","doc-0.12.90","v0.40.0","doc-0.12.89","doc-0.12.88","test-20220920","doc-0.12.87","doc-0.12.86","doc-0.12.85","doc-0.12.84","doc-0.12.83","v0.39.0","doc-0.12.82","doc-0.12.81","doc-0.12.80","doc-0.12.79","v0.38.2","doc-0.12.78","doc-0.12.77","v0.38.1","doc-0.12.76","v0.38.0","doc-0.12.75","test-0913","doc-0.12.74","v0.37.2","doc-0.12.73","v0.37.1","doc-0.12.72","doc-0.12.71","v0.37.0","test-0910","doc-0.12.70","doc-0.12.69","v0.36.2","doc-0.12.68","doc-0.12.67","v0.36.1","doc-0.12.66","doc-0.12.65","v0.36.0","doc-0.12.64","v0.35.0","doc-0.12.63","v0.34.0","doc-0.12.62","doc-0.12.61","doc-0.12.60","v0.33.0","doc-0.12.59","doc-0.12.58","v0.32.2","doc-0.12.57","v0.32.1","doc-0.12.56","doc-0.12.55","v0.32.0","doc-0.12.54","v0.31.0","doc-0.12.53","doc-0.12.52","doc-0.12.51","v0.30.1","doc-0.12.50","doc-0.12.49","v0.30.0","doc-0.12.48","doc-0.12.47","doc-0.12.46","v0.29.4","doc-0.12.45","v0.29.3","doc-0.12.44","v0.29.2","doc-0.12.43","v0.29.1","doc-0.12.42","v0.29.0","doc-0.12.41","v0.28.1","doc-0.12.40","doc-0.12.39","doc-0.12.38","v0.28.0","doc-0.12.37","doc-0.12.36","doc-0.12.35","v0.27.3","doc-0.12.34","doc-0.12.33","v0.27.2","doc-0.12.32","v0.27.1","doc-0.12.31","doc-0.12.30","v0.27.0","doc-0.12.29","doc-0.12.28","v0.26.1","doc-0.12.27","doc-0.12.26","v0.26.0","doc-0.12.25","doc-0.12.24","test-08314","test-08313","test-08312","test-0831","doc-0.12.23","doc-0.12.22","doc-0.12.21","test-26","doc-0.12.20","v0.25.5","doc-0.12.19","v0.25.4","test-25","doc-0.12.18","v0.25.3","doc-0.12.17","v0.25.2","doc-0.12.16","v0.25.1","doc-0.12.15","v0.25.0","doc-0.12.14","doc-0.12.13","doc-0.12.12","v0.24.0","doc-0.12.11","v0.23.4","doc-0.12.10","v0.23.3","doc-0.12.9","doc-0.12.8","v0.23.2","doc-0.12.7","v0.23.1","doc-0.12.6","v0.23.0","doc-0.12.5","doc-0.12.4","v0.22.1","doc-0.12.3","doc-0.12.2","doc-0.12.1","v0.22.0","test-0.22.1","test-0.22.0","doc-0.12.0","doc-0.11.34","doc-0.11.33","v0.21.1","test-0828","doc-0.11.32","doc-0.11.31","doc-0.11.30","doc-0.11.29","v0.21.0","test-ci1","doc-0.11.28","test-ci","doc-0.11.27","doc-0.11.26","v0.20.8","doc-0.11.25","v0.20.7","doc-0.11.24","v0.20.6","doc-0.11.23","v0.20.5","doc-0.11.22","v0.20.4","doc-0.11.21","v0.20.3","doc-0.11.20","v0.20.2","doc-0.11.19","doc-0.11.18","v0.20.1","doc-0.11.17","v0.20.0","doc-0.11.16","v0.19.1","doc-0.11.15","v0.19.0","doc-0.11.14","v0.18.1","doc-0.11.13","v0.18.0","doc-0.11.12","v0.17.0","doc-0.11.11","v0.16.2","v0.16.1","doc-0.11.10","v0.16.0","doc-0.11.9","v0.15.0","doc-0.11.8","v0.14.0","doc-0.11.7","v0.13.3","doc-0.11.6","doc-0.11.3","v0.13.2","v0.13.1","doc-0.11.2","doc-0.11.1","v0.13.0","doc-0.11.0","doc-0.10.3","doc-0.10.1","doc-0.10.0","v0.12.3","doc-0.9.2","doc-0.8.7","v0.12.2","v0.12.1","v0.12.0","doc-0.9.1","doc-0.9.0","doc-0.8.6","v0.11.1","v0.11.0","doc-0.8.5","doc-0.8.2","doc-0.8.1","v0.10.24","v0.10.23","v0.10.22","v0.10.21","doc-0.8.0","doc-0.7.3","v0.10.20","v0.10.19","v0.10.18","v0.10.17","v0.10.16","v0.10.15","v0.10.14","v0.10.13","v0.10.12","v0.10.11","v0.10.10","doc-0.7.2","doc-0.7.1","v0.10.9","doc-0.7.0","doc-0.5.0","v0.10.8","v0.10.7","v0.10.6","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.0","v0.8.0","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","doc-0.6.1","doc-0.6.0","v0.6.0","v0.5.11","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.01","v0.5.0","v0.4.2","v0.4.1","doc-0.4.1","doc-0.4.0","v0.4.0","v0.3.6","v0.3.5","v0.3.4","v0.3.3","doc-0.3.4","doc-0.3.3","doc-0.3.2","v0.3.2","doc-0.3.1","v0.3.1","v0.2.3","v0.2.2","v0.2.1","v0.2.0","doc0.2.0","doc-0.2.1","doc-0.2.0","doc0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129260.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P"}]}