CVE-2026-1810

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1810", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-03T14:03:44.422Z", "datePublished": "2026-02-03T20:32:07.343Z", "dateUpdated": "2026-02-23T09:15:31.194Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:15:31.194Z"}, "title": "bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "bolo-blog", "product": "bolo-solo", "versions": [{"version": "2.6.0", "status": "affected"}, {"version": "2.6.1", "status": "affected"}, {"version": "2.6.2", "status": "affected"}, {"version": "2.6.3", "status": "affected"}, {"version": "2.6.4", "status": "affected"}], "modules": ["ZIP File Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in bolo-blog bolo-solo up to 2.6.4. The impacted element is the function unpackFilteredZip of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component ZIP File Handler. Performing a manipulation of the argument File results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-03T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-05T12:20:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "MaoQiu (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.343978", "name": "VDB-343978 | bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343978", "name": "VDB-343978 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.742422", "name": "Submit #742422 | https://github.com/bolo-blog/bolo-solo/ bolo-solo V2.6.4 Write any file", "tags": ["third-party-advisory"]}, {"url": "https://github.com/bolo-blog/bolo-solo/issues/326", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/bolo-blog/bolo-solo/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T20:46:06.700366Z", "id": "CVE-2026-1810", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T20:46:15.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1810", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T20:46:06.700366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T20:46:11.895Z"}}], "cna": {"title": "bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "MaoQiu (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "bolo-blog", "modules": ["ZIP File Handler"], "product": "bolo-solo", "versions": [{"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.6.1"}, {"status": "affected", "version": "2.6.2"}, {"status": "affected", "version": "2.6.3"}, {"status": "affected", "version": "2.6.4"}]}], "timeline": [{"lang": "en", "time": "2026-02-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-03T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-05T12:20:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343978", "name": "VDB-343978 | bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343978", "name": "VDB-343978 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.742422", "name": "Submit #742422 | https://github.com/bolo-blog/bolo-solo/ bolo-solo V2.6.4 Write any file", "tags": ["third-party-advisory"]}, {"url": "https://github.com/bolo-blog/bolo-solo/issues/326", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/bolo-blog/bolo-solo/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in bolo-blog bolo-solo up to 2.6.4. The impacted element is the function unpackFilteredZip of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component ZIP File Handler. Performing a manipulation of the argument File results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:15:31.194Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1810", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:15:31.194Z", "dateReserved": "2026-02-03T14:03:44.422Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-03T20:32:07.343Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["ZIP File Handler"], "product": "bolo-solo", "vendor": "bolo-blog", "versions": [{"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.6.1"}, {"status": "affected", "version": "2.6.2"}, {"status": "affected", "version": "2.6.3"}, {"status": "affected", "version": "2.6.4"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adlered:bolo-solo:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5BC7EFC-81E9-4AD5-A024-C3C2AAFC80F9", "versionEndIncluding": "2.6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in bolo-blog bolo-solo up to 2.6.4. The impacted element is the function unpackFilteredZip of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component ZIP File Handler. Performing a manipulation of the argument File results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en bolo-blog bolo-solo hasta la versi\u00f3n 2.6.4. El elemento afectado es la funci\u00f3n unpackFilteredZip del archivo src/main/java/org/b3log/solo/bolo/prop/BackupService.java del componente 'ZIP File Handler'. Realizar una manipulaci\u00f3n del argumento File resulta en salto de ruta. El ataque puede ser llevado a cabo de forma remota. El exploit ahora es p\u00fablico y puede ser utilizado. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-1810", "lastModified": "2026-06-17T10:16:33.133", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1810", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T20:46:06.700366Z", "version": "2.0.3"}}]}, "published": "2026-02-03T21:16:12.617", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/bolo-blog/bolo-solo/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/bolo-blog/bolo-solo/issues/326"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.343978"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.343978"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.742422"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:04:28.266193+00:00", "value": {"mitigation_remediation": ["Check for an official patch or new release of bolo\u2011solo and install if available, ensuring the package version is beyond 2.6.4.", "Configure the ZIP extraction routine to run in a sandboxed directory with strict permissions, so even if traversal occurs the files cannot overwrite critical system files.", "Disable or restrict remote access to the API endpoint that triggers unpackFilteredZip, allowing only trusted internal hosts to submit ZIP archives.", "Add explicit validation of extracted file names to reject paths containing '../' or absolute paths before extraction."], "summary": {"action": "Patch Now", "impact": "Remote Path Traversal"}, "threat_synthesis": {"affected_systems": "The affected SKU is bolo\u2011blog's bolo\u2011solo package, impacting all installations up to version 2.6.4. No official patch version was disclosed at the time of writing, and the product is listed as vulnerable until a corrected release is applied.", "description_and_impact": "The vulnerability exists in the ZIP File Handler of bolo\u2011solo, where the unpackFilteredZip function fails to validate location paths when extracting files. Passing a crafted file name in the argument causes the extracted file to be written outside the intended directory, enabling attackers to overwrite arbitrary files or read sensitive data. The flaw allows remote exploitation and carries a moderate score for damage potential, meaning an attacker may compromise confidentiality and integrity of system files.", "risk_and_exploitability": "The CVSS score of 5.3 places the issue in the moderate band, while the EPSS rating of <1% suggests that automated exploitation is currently unlikely, though the vulnerability is public. It is not flagged in the CISA KEV catalog, but the remote attack vector and lack of vendor response mean that a determined adversary could still leverage this path traversal to tamper with configuration or application files, especially if the API endpoint is reachable from the internet."}}}}, "created": "2026-02-04T12:06:00.635697+00:00", "updated": "2026-04-18T00:15:31.773815+00:00", "vendors": ["bolo-blog", "bolo-blog$PRODUCT$bolo-solo"]}