CVE-2026-1813

Katalog CVE

CVSS 9.8 · Critical EPSS 0,38%

Kerentanan Improper Access Control pada adlered bolo-solo. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in bolo-blog bolo-solo up to 2.6.4. Affected is an unknown function of the file src/main/java/org/b3log/solo/bolo/pic/PicUploadProcessor.java of the component FreeMarker Template Handler. The manipulation of the argument File results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bolo-blog/bolo-solo/issues/329 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.343981 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.743402 advisory pihak ketiga · vdb entry
• https://github.com/bolo-blog/bolo-solo/ product
• https://vuldb.com/?ctiid.343981 permissions required · vdb entry