CVE-2026-1810
bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 3, 2026
- Updated
- Feb 23, 2026
- Reserved
- Feb 3, 2026
Description
A vulnerability was detected in bolo-blog bolo-solo up to 2.6.4. The impacted element is the function unpackFilteredZip of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component ZIP File Handler. Performing a manipulation of the argument File results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
bolo-solobolo-blog |
|
References
- VDB-343978 | bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversalvdb-entrytechnical-description
- VDB-343978 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #742422 | https://github.com/bolo-blog/bolo-solo/ bolo-solo V2.6.4 Write any filethird-party-advisory
- https://github.com/bolo-blog/bolo-solo/issues/326exploitissue-tracking
- https://github.com/bolo-blog/bolo-solo/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.