CVE-2026-129260

MEDIUM 6.6

Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal

CVSS Score

6.6

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version test-20261013 is able to resolve this issue. The identifier of the patch is d63aa163f10b6dc1080e2368fe8e71aa95b765cb. Upgrading the affected component is advised.

CWE	CWE-22
Vendor	mereithhh
Product	vanblog
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for mereithhh vanblog

Be the first to know when new medium vulnerabilities affecting mereithhh vanblog are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Mereithhh / VanBlog

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16 0.17 0.18 0.19 0.20 0.21 0.22 0.23 0.24 0.25 0.26 0.27 0.28 0.29 0.30 0.31 0.32 0.33 0.34 0.35 0.36 0.37 0.38 0.39 0.40 0.41 0.42 0.43 0.44 0.45 0.46 0.47 0.48 0.49 0.50 0.51 0.52 0.53 0.54.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/437298 vuldb.com: https://vuldb.com/vuln/437298/cti vuldb.com: https://vuldb.com/cve/CVE-2026-129260 vuldb.com: https://vuldb.com/submit/1043274 note.geronimo.xin: http://note.geronimo.xin/post/71 github.com: https://github.com/Mereithhh/vanblog/pull/524 github.com: https://github.com/Mereithhh/vanblog/commit/d63aa163f10b6dc1080e2368fe8e71aa95b765cb github.com: https://github.com/Mereithhh/vanblog/releases/tag/test-20261013 github.com: https://github.com/Mereithhh/vanblog/

Credits

🔍 Geronimo (VulDB User)