CVE-2026-1813: Bolo-solo Unrestricted File Upload in FreeMarker Template Handler
CVE-2026-1813 is an unrestricted file upload flaw (CWE-434) in Bolo-solo up to version 2.6.4, affecting a function in the FreeMarker Template Handler component. NVD assigns a CVSS 3.1 base score of 9.8 (critical), while the CNA VulDB scores are lower, and the record states that a public exploit exists. The project was reported through an issue and had not responded at the time of the record.
Overview
CVE-2026-1813 affects Bolo-solo, a Java blog project, in versions up to and including 2.6.4. The record describes an unrestricted upload issue in an unspecified function of the FreeMarker Template Handler component, tied to the picture upload processor. The weakness is classified as CWE-434, Unrestricted Upload of File with Dangerous Type.
Impact
According to the record, the flaw can be triggered remotely. NVD scores it 9.8 under CVSS 3.1 with high confidentiality, integrity and availability impact and no privileges or user interaction required. The CNA VulDB scores are considerably lower (6.3 under 3.1, 6.5 under 2.0 and 2.1 under 4.0), so the severity depends on which scoring source is used. Any real-world impact on a specific deployment is an inference and depends on how the application is exposed.
Affected products and versions
- Adlered Bolo-solo (repository published as bolo-blog/bolo-solo): versions up to and including 2.6.4.
- Component: FreeMarker Template Handler, picture upload processing.
The record does not list any fixed version.
Exploitation status
The CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation in the wild is stated. The record does say that the exploit has been made public and could be used. A GitHub issue tagged with Exploit is among the references. No confirmed exploitation appears in the sources consulted beyond this public availability.
Remediation and mitigation
- No vendor fix or patched version is identified in the record, so the absence of a fixed version is unknown rather than proof that no fix exists.
- Check the project repository for newer releases or commits that address the upload handling, and monitor the linked issue for vendor responses.
- Until a fix is confirmed, consider restricting access to the upload functionality, limiting it to trusted users, and placing the application behind controls that reduce exposure.
- Review file type validation, storage location and execution permissions for uploaded content, as defensive hardening.
Detection guidance
- Review web server and application logs for unusual upload requests to picture or media upload endpoints, especially from unknown sources.
- Monitor the upload storage directories for unexpected file types, names or recently created executable or template content.
- Alert on unexpected server-side processing of newly uploaded files.
Limitations of the available information
The record does not identify the exact vulnerable function, a fixed version, a vendor response, or the full set of deployment conditions. The vendor has not responded according to the description. Scores from different CNA and NVD sources differ, and the exploit's technical details are not provided here by design.
Frequently asked questions
Is CVE-2026-1813 being actively exploited?
The record does not list the CVE in CISA KEV, so no confirmed active exploitation in the wild is stated. It does say that a public exploit exists and could be used.
Which Bolo-solo versions are affected?
The record lists versions up to and including 2.6.4. No fixed version is identified in the available sources.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.