CVE-2026-1812: bolo-solo Path Traversal in importFromCnblogs

Overview

CVE-2026-1812 affects bolo-solo up to and including version 2.6.4. According to the record, the weakness is in the importFromCnblogs function of the backup service and is classified as path traversal (CWE-22). The report was first raised through the project's GitHub issue tracker.

Impact

• NVD assigns a base score of 9.8 (Critical) under CVSS 3.1, with high impact values for confidentiality, integrity and availability.
• The NVD vector indicates that no privileges and no user interaction are required.
• Path traversal generally allows access to locations outside the intended directory. The exact effect in a given deployment is not described in the record and depends on how the application runs (inference).

Affected products and versions

• Product listed in the record: Adlered Bolo-solo, versions less than or equal to 2.6.4.
• The record names the vendor differently from the GitHub repository owner (bolo-blog). Administrators should confirm which builds are affected with the project.
• No fixed version is listed in the sources consulted.

Exploitation status

• The record states that the exploit has been disclosed to the public and may be used.
• The vulnerability is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
• No EPSS score is available in the record. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

• No vendor fix is recorded, and the project had not responded to the report at the time of the record. Monitor the project repository and the GitHub issue for an update.
• Until an official fix is available, restrict network access to the application and its administrative functions to trusted users.
• Limit or disable backup and import features that accept file paths from untrusted sources.
• Run the application with the minimum file system permissions it needs, so that it cannot read sensitive files outside its data directory.
• Keep current backups of content and configuration so the application can be restored if it is compromised.

Detection guidance

• Review application and web server logs for requests to backup or import functions that contain unusual path values.
• Monitor the application process for file access outside its expected data directories.
• Alert on unexpected changes to configuration or content files after import operations.

Limitations of the available information

• No fixed version, vendor patch or vendor statement is recorded.
• EPSS and SSVC data are not available in the record.
• Other CNA scores in the record differ from the NVD score and use different CVSS versions; the NVD score is the one reported here.
• The record does not describe the technical scope of the file access, so the full data exposure cannot be determined.
• The record does not confirm the vendor name mapping between the affected product entry and the GitHub repository.

Frequently asked questions

What is CVE-2026-1812?

It is a path traversal weakness (CWE-22) in the importFromCnblogs function of bolo-solo, affecting versions up to and including 2.6.4, according to the record.

Is there a fix available?

No fixed version is listed in the sources consulted, and the project had not responded to the report when the record was prepared. Check the project repository for updates.

Is this vulnerability being actively exploited?

It is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been disclosed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.